/[jscoverage]/trunk/js/jsemit.cpp

Diff of /trunk/js/jsemit.cpp

Parent Directory | Revision Log | View Patch Patch

-revision 459 by siliconforks,
Tue Dec  9 03:37:47 2008 UTC
+revision 460 by siliconforks,
Sat Sep 26 23:15:22 2009 UTC
 Line 45
  #ifdef HAVE_MEMORY_H
  #include <memory.h>
  #endif
+ #include <new>
  #include <string.h>
  #include "jstypes.h"
  #include "jsarena.h" /* Added by JSIFY */
-Line 82
+Line 83
  NewTryNote(JSContext *cx, JSCodeGenerator *cg, JSTryNoteKind kind,
             uintN stackDepth, size_t start, size_t end);
- JS_FRIEND_API(void)
+ JSCodeGenerator::JSCodeGenerator(JSCompiler *jsc,
- js_InitCodeGenerator(JSContext *cx, JSCodeGenerator *cg, JSParseContext *pc,
+                                  JSArenaPool *cpool, JSArenaPool *npool,
-                      JSArenaPool *codePool, JSArenaPool *notePool,
+                                  uintN lineno)
-                      uintN lineno)
+   : JSTreeContext(jsc),
- {
+     codePool(cpool), notePool(npool),
-     memset(cg, 0, sizeof *cg);
+     codeMark(JS_ARENA_MARK(cpool)), noteMark(JS_ARENA_MARK(npool)),
-     TREE_CONTEXT_INIT(&cg->treeContext, pc);
+     stackDepth(0), maxStackDepth(0),
-     cg->codePool = codePool;
+     ntrynotes(0), lastTryNode(NULL),
-     cg->notePool = notePool;
+     spanDeps(NULL), jumpTargets(NULL), jtFreeList(NULL),
-     cg->codeMark = JS_ARENA_MARK(codePool);
+     numSpanDeps(0), numJumpTargets(0), spanDepTodo(0),
-     cg->noteMark = JS_ARENA_MARK(notePool);
+     arrayCompDepth(0),
-     cg->current = &cg->main;
+     emitLevel(0)
-     cg->firstLine = cg->prolog.currentLine = cg->main.currentLine = lineno;
+ {
-     ATOM_LIST_INIT(&cg->atomList);
+     flags = TCF_COMPILING;
-     cg->prolog.noteMask = cg->main.noteMask = SRCNOTE_CHUNK - 1;
+     memset(&prolog, 0, sizeof prolog);
-     ATOM_LIST_INIT(&cg->constList);
+     memset(&main, 0, sizeof main);
-     ATOM_LIST_INIT(&cg->upvarList);
+     current = &main;
- }
+     firstLine = prolog.currentLine = main.currentLine = lineno;
+     prolog.noteMask = main.noteMask = SRCNOTE_CHUNK - 1;
- JS_FRIEND_API(void)
+     memset(&upvarMap, 0, sizeof upvarMap);
- js_FinishCodeGenerator(JSContext *cx, JSCodeGenerator *cg)
+ }
- {
-     TREE_CONTEXT_FINISH(cx, &cg->treeContext);
+ JSCodeGenerator::~JSCodeGenerator()
-     JS_ARENA_RELEASE(cg->codePool, cg->codeMark);
+ {
-     JS_ARENA_RELEASE(cg->notePool, cg->noteMark);
+     JS_ARENA_RELEASE(codePool, codeMark);
+     JS_ARENA_RELEASE(notePool, noteMark);
      /* NB: non-null only after OOM. */
-     if (cg->spanDeps)
+     if (spanDeps)
-         JS_free(cx, cg->spanDeps);
+         JS_free(compiler->context, spanDeps);
-     if (cg->upvarMap.vector)
+     if (upvarMap.vector)
-         JS_free(cx, cg->upvarMap.vector);
+         JS_free(compiler->context, upvarMap.vector);
  }
  static ptrdiff_t
-Line 157
+Line 159
      jsbytecode *pc;
      JSOp op;
      const JSCodeSpec *cs;
-     uintN depth;
+     uintN extra, depth, nuses;
-     intN nuses, ndefs;
+     intN ndefs;
      pc = CG_CODE(cg, target);
      op = (JSOp) *pc;
      cs = &js_CodeSpec[op];
-     if (cs->format & JOF_TMPSLOT_MASK) {
+ #ifdef JS_TRACER
+     extern uint8 js_opcode2extra[];
+     extra = js_opcode2extra[op];
+ #else
+     extra = 0;
+ #endif
+     if ((cs->format & JOF_TMPSLOT_MASK) || extra) {
          depth = (uintN) cg->stackDepth +
-                 ((cs->format & JOF_TMPSLOT_MASK) >> JOF_TMPSLOT_SHIFT);
+                 ((cs->format & JOF_TMPSLOT_MASK) >> JOF_TMPSLOT_SHIFT) +
+                 extra;
          if (depth > cg->maxStackDepth)
              cg->maxStackDepth = depth;
      }
-     nuses = cs->nuses;
-     if (nuses < 0)
+     nuses = js_GetStackUses(cs, op, pc);
-         nuses = js_GetVariableStackUseLength(op, pc);
      cg->stackDepth -= nuses;
      JS_ASSERT(cg->stackDepth >= 0);
      if (cg->stackDepth < 0) {
-Line 179
+Line 187
          JSTokenStream *ts;
          JS_snprintf(numBuf, sizeof numBuf, "%d", target);
-         ts = &cg->treeContext.parseContext->tokenStream;
+         ts = &cg->compiler->tokenStream;
          JS_ReportErrorFlagsAndNumber(cx, JSREPORT_WARNING,
                                       js_GetErrorMessage, NULL,
                                       JSMSG_STACK_UNDERFLOW,
-Line 193
+Line 201
          /* We just executed IndexParsedObject */
          JS_ASSERT(op == JSOP_ENTERBLOCK);
          JS_ASSERT(nuses == 0);
-         blockObj = cg->objectList.lastPob->object;
+         blockObj = cg->objectList.lastbox->object;
          JS_ASSERT(STOBJ_GET_CLASS(blockObj) == &js_BlockClass);
          JS_ASSERT(JSVAL_IS_VOID(blockObj->fslots[JSSLOT_BLOCK_DEPTH]));
-Line 299
+Line 307
  static const char *
  StatementName(JSCodeGenerator *cg)
  {
-     if (!cg->treeContext.topStmt)
+     if (!cg->topStmt)
          return js_script_str;
-     return statementName[cg->treeContext.topStmt->type];
+     return statementName[cg->topStmt->type];
  }
  static void
-Line 885
+Line 893
      if (growth) {
  #ifdef DEBUG_brendan
-         JSTokenStream *ts = &cg->treeContext.parseContext->tokenStream;
+         JSTokenStream *ts = &cg->compiler->tokenStream;
          printf("%s:%u: %u/%u jumps extended in %d passes (%d=%d+%d)\n",
                 ts->filename ? ts->filename : "stdin", cg->firstLine,
-Line 1225
+Line 1233
      return SetSpanDepTarget(cx, cg, GetSpanDep(cg, pc), off);
  }
- JSBool
+ bool
- js_InStatement(JSTreeContext *tc, JSStmtType type)
+ JSTreeContext::inStatement(JSStmtType type)
  {
-     JSStmtInfo *stmt;
+     for (JSStmtInfo *stmt = topStmt; stmt; stmt = stmt->down) {
-     for (stmt = tc->topStmt; stmt; stmt = stmt->down) {
          if (stmt->type == type)
-             return JS_TRUE;
+             return true;
      }
-     return JS_FALSE;
+     return false;
  }
  void
-Line 1243
+Line 1249
  {
      stmt->type = type;
      stmt->flags = 0;
+     stmt->blockid = tc->blockid();
      SET_STATEMENT_TOP(stmt, top);
-     stmt->u.label = NULL;
+     stmt->label = NULL;
-     JS_ASSERT(!stmt->u.blockObj);
+     JS_ASSERT(!stmt->blockObj);
      stmt->down = tc->topStmt;
      tc->topStmt = stmt;
      if (STMT_LINKS_SCOPE(stmt)) {
-Line 1260
+Line 1267
  js_PushBlockScope(JSTreeContext *tc, JSStmtInfo *stmt, JSObject *blockObj,
                    ptrdiff_t top)
  {
      js_PushStatement(tc, stmt, STMT_BLOCK, top);
      stmt->flags |= SIF_SCOPE;
      STOBJ_SET_PARENT(blockObj, tc->blockChain);
      stmt->downScope = tc->topScopeStmt;
      tc->topScopeStmt = stmt;
      tc->blockChain = blockObj;
-     stmt->u.blockObj = blockObj;
+     stmt->blockObj = blockObj;
  }
  /*
-Line 1329
+Line 1335
  #define FLUSH_POPS() if (npops && !FlushPops(cx, cg, &npops)) return JS_FALSE
-     for (stmt = cg->treeContext.topStmt; stmt != toStmt; stmt = stmt->down) {
+     for (stmt = cg->topStmt; stmt != toStmt; stmt = stmt->down) {
          switch (stmt->type) {
            case STMT_FINALLY:
              FLUSH_POPS();
-Line 1377
+Line 1383
              FLUSH_POPS();
              if (js_NewSrcNote(cx, cg, SRC_HIDDEN) < 0)
                  return JS_FALSE;
-             i = OBJ_BLOCK_COUNT(cx, stmt->u.blockObj);
+             i = OBJ_BLOCK_COUNT(cx, stmt->blockObj);
              EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, i);
          }
      }
-Line 1445
+Line 1451
      if (STMT_LINKS_SCOPE(stmt)) {
          tc->topScopeStmt = stmt->downScope;
          if (stmt->flags & SIF_SCOPE) {
-             tc->blockChain = STOBJ_GET_PARENT(stmt->u.blockObj);
+             tc->blockChain = STOBJ_GET_PARENT(stmt->blockObj);
              JS_SCOPE_DEPTH_METERING(--tc->scopeDepth);
          }
      }
-Line 1456
+Line 1462
  {
      JSStmtInfo *stmt;
-     stmt = cg->treeContext.topStmt;
+     stmt = cg->topStmt;
      if (!STMT_IS_TRYING(stmt) &&
          (!BackPatch(cx, cg, stmt->breaks, CG_NEXT(cg), JSOP_GOTO) ||
           !BackPatch(cx, cg, stmt->continues, CG_CODE(cg, stmt->update),
                      JSOP_GOTO))) {
          return JS_FALSE;
      }
-     js_PopStatement(&cg->treeContext);
+     js_PopStatement(cg);
      return JS_TRUE;
  }
-Line 1493
+Line 1499
                  return JS_FALSE;
              v = ATOM_KEY(valueAtom);
          }
-         ale = js_IndexAtom(cx, atom, &cg->constList);
+         ale = cg->constList.add(cg->compiler, atom);
          if (!ale)
              return JS_FALSE;
          ALE_SET_VALUE(ale, v);
-Line 1502
+Line 1508
  }
  JSStmtInfo *
- js_LexicalLookup(JSTreeContext *tc, JSAtom *atom, jsint *slotp)
+ js_LexicalLookup(JSTreeContext *tc, JSAtom *atom, jsint *slotp, JSStmtInfo *stmt)
  {
-     JSStmtInfo *stmt;
      JSObject *obj;
      JSScope *scope;
      JSScopeProperty *sprop;
-     for (stmt = tc->topScopeStmt; stmt; stmt = stmt->downScope) {
+     if (!stmt)
+         stmt = tc->topScopeStmt;
+     for (; stmt; stmt = stmt->downScope) {
          if (stmt->type == STMT_WITH)
              break;
-Line 1517
+Line 1524
          if (!(stmt->flags & SIF_SCOPE))
              continue;
-         obj = stmt->u.blockObj;
+         obj = stmt->blockObj;
          JS_ASSERT(LOCKED_OBJ_GET_CLASS(obj) == &js_BlockClass);
          scope = OBJ_SCOPE(obj);
          sprop = SCOPE_GET_PROPERTY(scope, ATOM_TO_JSID(atom));
-Line 1557
+Line 1564
      JSBool ok;
      JSStmtInfo *stmt;
      JSAtomListElement *ale;
-     JSObject *obj, *pobj;
+     JSObject *obj, *objbox;
      JSProperty *prop;
      uintN attrs;
-Line 1568
+Line 1575
       */
      *vp = JSVAL_HOLE;
      do {
-         if (cg->treeContext.flags & (TCF_IN_FUNCTION | TCF_COMPILE_N_GO)) {
+         if (cg->flags & (TCF_IN_FUNCTION | TCF_COMPILE_N_GO)) {
-             /* XXX this will need revising when 'let const' is added. */
+             /* XXX this will need revising if 'const' becomes block-scoped. */
-             stmt = js_LexicalLookup(&cg->treeContext, atom, NULL);
+             stmt = js_LexicalLookup(cg, atom, NULL);
              if (stmt)
                  return JS_TRUE;
-             ATOM_LIST_SEARCH(ale, &cg->constList, atom);
+             ale = cg->constList.lookup(atom);
              if (ale) {
                  JS_ASSERT(ALE_VALUE(ale) != JSVAL_HOLE);
                  *vp = ALE_VALUE(ale);
-Line 1588
+Line 1595
               * with object or catch variable; nor can prop's value be changed,
               * nor can prop be deleted.
               */
-             if (cg->treeContext.flags & TCF_IN_FUNCTION) {
+             if (cg->flags & TCF_IN_FUNCTION) {
-                 if (js_LookupLocal(cx, cg->treeContext.u.fun, atom, NULL) !=
+                 if (js_LookupLocal(cx, cg->fun, atom, NULL) != JSLOCAL_NONE)
-                     JSLOCAL_NONE) {
                      break;
-                 }
              } else {
-                 JS_ASSERT(cg->treeContext.flags & TCF_COMPILE_N_GO);
+                 JS_ASSERT(cg->flags & TCF_COMPILE_N_GO);
-                 obj = cg->treeContext.u.scopeChain;
+                 obj = cg->scopeChain;
-                 ok = OBJ_LOOKUP_PROPERTY(cx, obj, ATOM_TO_JSID(atom), &pobj,
+                 ok = OBJ_LOOKUP_PROPERTY(cx, obj, ATOM_TO_JSID(atom), &objbox,
                                           &prop);
                  if (!ok)
                      return JS_FALSE;
-                 if (pobj == obj) {
+                 if (objbox == obj) {
                      /*
                       * We're compiling code that will be executed immediately,
                       * not re-executed against a different scope chain and/or
-Line 1615
+Line 1620
                      }
                  }
                  if (prop)
-                     OBJ_DROP_PROPERTY(cx, pobj, prop);
+                     OBJ_DROP_PROPERTY(cx, objbox, prop);
                  if (!ok)
                      return JS_FALSE;
                  if (prop)
                      break;
              }
          }
-     } while ((cg = cg->parent) != NULL);
+     } while ((cg = (JSCodeGenerator *) cg->parent) != NULL);
      return JS_TRUE;
  }
-Line 1697
+Line 1702
              return JS_FALSE;                                                  \
      JS_END_MACRO
  static JSBool
  EmitAtomOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg)
  {
-Line 1708
+Line 1712
          pn->pn_atom == cx->runtime->atomState.lengthAtom) {
          return js_Emit1(cx, cg, JSOP_LENGTH) >= 0;
      }
-     ale = js_IndexAtom(cx, pn->pn_atom, &cg->atomList);
+     ale = cg->atomList.add(cg->compiler, pn->pn_atom);
      if (!ale)
          return JS_FALSE;
      return EmitIndexOp(cx, op, ALE_INDEX(ale), cg);
  }
- static uintN
- IndexParsedObject(JSParsedObjectBox *pob, JSEmittedObjectList *list);
  static JSBool
- EmitObjectOp(JSContext *cx, JSParsedObjectBox *pob, JSOp op,
+ EmitObjectOp(JSContext *cx, JSObjectBox *objbox, JSOp op,
               JSCodeGenerator *cg)
  {
      JS_ASSERT(JOF_OPTYPE(op) == JOF_OBJECT);
-     return EmitIndexOp(cx, op, IndexParsedObject(pob, &cg->objectList), cg);
+     return EmitIndexOp(cx, op, cg->objectList.index(objbox), cg);
  }
  /*
-Line 1737
+Line 1738
  static JSBool
  EmitSlotIndexOp(JSContext *cx, JSOp op, uintN slot, uintN index,
-                  JSCodeGenerator *cg)
+                 JSCodeGenerator *cg)
  {
      JSOp bigSuffix;
      ptrdiff_t off;
-Line 1764
+Line 1765
   * Adjust the slot for a block local to account for the number of variables
   * that share the same index space with locals. Due to the incremental code
   * generation for top-level script, we do the adjustment via code patching in
-  * js_CompileScript; see comments there.
+  * JSCompiler::compileScript; see comments there.
   *
   * The function returns -1 on failures.
   */
-Line 1772
+Line 1773
  AdjustBlockSlot(JSContext *cx, JSCodeGenerator *cg, jsint slot)
  {
      JS_ASSERT((jsuint) slot < cg->maxStackDepth);
-     if (cg->treeContext.flags & TCF_IN_FUNCTION) {
+     if (cg->flags & TCF_IN_FUNCTION) {
-         slot += cg->treeContext.u.fun->u.i.nvars;
+         slot += cg->fun->u.i.nvars;
          if ((uintN) slot >= SLOTNO_LIMIT) {
              js_ReportCompileErrorNumber(cx, CG_TS(cg), NULL,
                                          JSREPORT_ERROR,
-Line 1784
+Line 1785
      return slot;
  }
+ static bool
+ EmitEnterBlock(JSContext *cx, JSParseNode *pn, JSCodeGenerator *cg)
+ {
+     JS_ASSERT(PN_TYPE(pn) == TOK_LEXICALSCOPE);
+     if (!EmitObjectOp(cx, pn->pn_objbox, JSOP_ENTERBLOCK, cg))
+         return false;
+     JSObject *blockObj = pn->pn_objbox->object;
+     jsint depth = AdjustBlockSlot(cx, cg, OBJ_BLOCK_DEPTH(cx, blockObj));
+     if (depth < 0)
+         return false;
+     for (uintN slot = JSSLOT_FREE(&js_BlockClass),
+                limit = slot + OBJ_BLOCK_COUNT(cx, blockObj);
+          slot < limit; slot++) {
+         jsval v = STOBJ_GET_SLOT(blockObj, slot);
+         /* Beware the empty destructuring dummy. */
+         if (JSVAL_IS_VOID(v)) {
+             JS_ASSERT(slot + 1 <= limit);
+             continue;
+         }
+         JSDefinition *dn = (JSDefinition *) JSVAL_TO_PRIVATE(v);
+         JS_ASSERT(dn->pn_defn);
+         JS_ASSERT(uintN(dn->frameSlot() + depth) < JS_BIT(16));
+         dn->pn_cookie += depth;
+ #ifdef DEBUG
+         for (JSParseNode *pnu = dn->dn_uses; pnu; pnu = pnu->pn_link) {
+             JS_ASSERT(pnu->pn_lexdef == dn);
+             JS_ASSERT(!(pnu->pn_dflags & PND_BOUND));
+             JS_ASSERT(pnu->pn_cookie == FREE_UPVAR_COOKIE);
+         }
+ #endif
+     }
+     OBJ_SCOPE(blockObj)->freeslot = JSSLOT_FREE(&js_BlockClass);
+     js_ReallocSlots(cx, blockObj, JSSLOT_FREE(&js_BlockClass), JS_TRUE);
+     return true;
+ }
  /*
-  * This routine tries to optimize name gets and sets to stack slot loads and
+  * When eval is called from a function, the eval code or function code it
-  * stores, given the variables object and scope chain in cx's top frame, the
+  * compiles may reference upvars that live in the eval-calling function. The
-  * compile-time context in tc, and a TOK_NAME node pn.  It returns false on
+  * eval-invoked compiler does not have explicit definitions for these upvars
-  * error, true on success.
+  * and we do not attempt to create them a-priori (by inspecting the function's
+  * args and vars) -- we could, but we'd take an avoidable penalty for each
+  * function local not referenced by any upvar. Instead, we map such upvars
+  * lazily, growing upvarMap.vector by powers of two.
   *
-  * The caller can inspect pn->pn_slot for a non-negative slot number to tell
+  * This function knows that it is called with pn pointing to a PN_NAME-arity
-  * whether optimization occurred, in which case BindNameToSlot also updated
+  * node, and cg->compiler->callerFrame having a non-null fun member, and the
-  * pn->pn_op.  If pn->pn_slot is still -1 on return, pn->pn_op nevertheless
+  * static level of cg at least one greater than the eval-calling function's
-  * may have been optimized, e.g., from JSOP_NAME to JSOP_ARGUMENTS.  Whether
+  * static level.
-  * or not pn->pn_op was modified, if this function finds an argument or local
+  */
-  * variable name, pn->pn_const will be true for const properties after a
+ static bool
+ MakeUpvarForEval(JSParseNode *pn, JSCodeGenerator *cg)
+ {
+     JSContext *cx = cg->compiler->context;
+     JSFunction *fun = cg->compiler->callerFrame->fun;
+     uintN upvarLevel = fun->u.i.script->staticLevel;
+     JSFunctionBox *funbox = cg->funbox;
+     if (funbox) {
+         /*
+          * Treat top-level function definitions as escaping (i.e., as funargs),
+          * required since we compile each such top level function or statement
+          * and throw away the AST, so we can't yet see all funarg uses of this
+          * function being compiled (cg->funbox->object). See bug 493177.
+          */
+         if (funbox->level == fun->u.i.script->staticLevel + 1U &&
+             !(((JSFunction *) funbox->object)->flags & JSFUN_LAMBDA)) {
+             JS_ASSERT_IF(cx->options & JSOPTION_ANONFUNFIX,
+                          ((JSFunction *) funbox->object)->atom);
+             return true;
+         }
+         while (funbox->level >= upvarLevel) {
+             if (funbox->node->pn_dflags & PND_FUNARG)
+                 return true;
+             funbox = funbox->parent;
+             if (!funbox)
+                 break;
+         }
+     }
+     JSAtom *atom = pn->pn_atom;
+     uintN index;
+     JSLocalKind localKind = js_LookupLocal(cx, fun, atom, &index);
+     if (localKind == JSLOCAL_NONE)
+         return true;
+     JS_ASSERT(cg->staticLevel > upvarLevel);
+     if (cg->staticLevel >= JS_DISPLAY_SIZE || upvarLevel >= JS_DISPLAY_SIZE)
+         return true;
+     JSAtomListElement *ale = cg->upvarList.lookup(atom);
+     if (!ale) {
+         if ((cg->flags & TCF_IN_FUNCTION) &&
+             !js_AddLocal(cx, cg->fun, atom, JSLOCAL_UPVAR)) {
+             return false;
+         }
+         ale = cg->upvarList.add(cg->compiler, atom);
+         if (!ale)
+             return false;
+         JS_ASSERT(ALE_INDEX(ale) == cg->upvarList.count - 1);
+         uint32 *vector = cg->upvarMap.vector;
+         uint32 length = cg->upvarMap.length;
+         JS_ASSERT(ALE_INDEX(ale) <= length);
+         if (ALE_INDEX(ale) == length) {
+             length = 2 * JS_MAX(2, length);
+             vector = (uint32 *) JS_realloc(cx, vector, length * sizeof *vector);
+             if (!vector)
+                 return false;
+             cg->upvarMap.vector = vector;
+             cg->upvarMap.length = length;
+         }
+         if (localKind != JSLOCAL_ARG)
+             index += fun->nargs;
+         JS_ASSERT(index < JS_BIT(16));
+         uintN skip = cg->staticLevel - upvarLevel;
+         vector[ALE_INDEX(ale)] = MAKE_UPVAR_COOKIE(skip, index);
+     }
+     pn->pn_op = JSOP_GETUPVAR;
+     pn->pn_cookie = MAKE_UPVAR_COOKIE(cg->staticLevel, ALE_INDEX(ale));
+     pn->pn_dflags |= PND_BOUND;
+     return true;
+ }
+ /*
+  * BindNameToSlot attempts to optimize name gets and sets to stack slot loads
+  * and stores, given the compile-time information in cg and a TOK_NAME node pn.
+  * It returns false on error, true on success.
+  *
+  * The caller can inspect pn->pn_cookie for FREE_UPVAR_COOKIE to tell whether
+  * optimization occurred, in which case BindNameToSlot also updated pn->pn_op.
+  * If pn->pn_cookie is still FREE_UPVAR_COOKIE on return, pn->pn_op still may
+  * have been optimized, e.g., from JSOP_NAME to JSOP_CALLEE.  Whether or not
+  * pn->pn_op was modified, if this function finds an argument or local variable
+  * name, PND_CONST will be set in pn_dflags for read-only properties after a
   * successful return.
   *
   * NB: if you add more opcodes specialized from JSOP_NAME, etc., don't forget
-Line 1805
+Line 1941
  static JSBool
  BindNameToSlot(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
  {
-     JSTreeContext *tc;
+     JSDefinition *dn;
-     JSAtom *atom;
-     JSStmtInfo *stmt;
-     jsint slot;
      JSOp op;
-     JSLocalKind localKind;
+     JSAtom *atom;
-     uintN index;
+     uint32 cookie;
+     JSDefinition::Kind dn_kind;
      JSAtomListElement *ale;
-     JSBool constOp;
+     uintN index;
      JS_ASSERT(pn->pn_type == TOK_NAME);
-     if (pn->pn_slot >= 0 || pn->pn_op == JSOP_ARGUMENTS)
-         return JS_TRUE;
-     /* QNAME references can never be optimized to use arg/var storage. */
+     /* Idempotency tests come first, since we may be called more than once. */
-     if (pn->pn_op == JSOP_QNAMEPART)
+     if (pn->pn_dflags & PND_BOUND)
          return JS_TRUE;
+     /* No cookie initialized for these two, they're pre-bound by definition. */
+     JS_ASSERT(pn->pn_op != JSOP_ARGUMENTS && pn->pn_op != JSOP_CALLEE);
      /*
-      * We can't optimize if we are compiling a with statement and its body,
+      * The parser linked all uses (including forward references) to their
-      * or we're in a catch block whose exception variable has the same name
+      * definitions, unless a with statement or direct eval intervened.
-      * as this node.  FIXME: we should be able to optimize catch vars to be
-      * block-locals.
       */
-     tc = &cg->treeContext;
+     if (pn->pn_used) {
-     atom = pn->pn_atom;
+         JS_ASSERT(pn->pn_cookie == FREE_UPVAR_COOKIE);
-     stmt = js_LexicalLookup(tc, atom, &slot);
+         dn = pn->pn_lexdef;
-     if (stmt) {
+         JS_ASSERT(dn->pn_defn);
-         if (stmt->type == STMT_WITH)
+         pn->pn_dflags |= (dn->pn_dflags & PND_CONST);
+     } else {
+         if (!pn->pn_defn)
              return JS_TRUE;
+         dn = (JSDefinition *) pn;
+     }
-         JS_ASSERT(stmt->flags & SIF_SCOPE);
+     op = PN_OP(pn);
-         JS_ASSERT(slot >= 0);
+     if (op == JSOP_NOP)
-         op = PN_OP(pn);
-         switch (op) {
-           case JSOP_NAME:     op = JSOP_GETLOCAL; break;
-           case JSOP_SETNAME:  op = JSOP_SETLOCAL; break;
-           case JSOP_INCNAME:  op = JSOP_INCLOCAL; break;
-           case JSOP_NAMEINC:  op = JSOP_LOCALINC; break;
-           case JSOP_DECNAME:  op = JSOP_DECLOCAL; break;
-           case JSOP_NAMEDEC:  op = JSOP_LOCALDEC; break;
-           case JSOP_FORNAME:  op = JSOP_FORLOCAL; break;
-           case JSOP_DELNAME:  op = JSOP_FALSE; break;
-           default: JS_ASSERT(0);
-         }
-         if (op != pn->pn_op) {
-             slot = AdjustBlockSlot(cx, cg, slot);
-             if (slot < 0)
-                 return JS_FALSE;
-             pn->pn_op = op;
-             pn->pn_slot = slot;
-         }
          return JS_TRUE;
-     }
+     JS_ASSERT(JOF_OPTYPE(op) == JOF_ATOM);
+     atom = pn->pn_atom;
+     cookie = dn->pn_cookie;
+     dn_kind = dn->kind();
      /*
-      * We can't optimize if var and closure (a local function not in a larger
+      * Turn attempts to mutate const-declared bindings into get ops (for
-      * expression and not at top-level within another's body) collide.
+      * pre-increment and pre-decrement ops, our caller will have to emit
-      * XXX suboptimal: keep track of colliding names and deoptimize only those
+      * JSOP_POS, JSOP_ONE, and JSOP_ADD as well).
+      *
+      * Turn JSOP_DELNAME into JSOP_FALSE if dn is known, as all declared
+      * bindings visible to the compiler are permanent in JS unless the
+      * declaration originates in eval code. We detect eval code by testing
+      * cg->compiler->callerFrame, which is set only by eval or a debugger
+      * equivalent.
+      *
+      * Note that this callerFrame non-null test must be qualified by testing
+      * !cg->funbox to exclude function code nested in eval code, which is not
+      * subject to the deletable binding exception.
       */
-     if (tc->flags & TCF_FUN_CLOSURE_VS_VAR)
+     switch (op) {
-         return JS_TRUE;
+       case JSOP_NAME:
+       case JSOP_SETCONST:
-     if (!(tc->flags & TCF_IN_FUNCTION)) {
+         break;
-         JSStackFrame *caller;
+       case JSOP_DELNAME:
+         if (dn_kind != JSDefinition::UNKNOWN) {
+             if (cg->compiler->callerFrame && !cg->funbox)
+                 JS_ASSERT(cg->flags & TCF_COMPILE_N_GO);
+             else
+                 pn->pn_op = JSOP_FALSE;
+             pn->pn_dflags |= PND_BOUND;
+             return JS_TRUE;
+         }
+         break;
+       default:
+         if (pn->isConst())
+             pn->pn_op = op = JSOP_NAME;
+     }
-         caller = tc->parseContext->callerFrame;
+     if (cookie == FREE_UPVAR_COOKIE) {
+         JSStackFrame *caller = cg->compiler->callerFrame;
          if (caller) {
-             JS_ASSERT(tc->flags & TCF_COMPILE_N_GO);
+             JS_ASSERT(cg->flags & TCF_COMPILE_N_GO);
+             /*
+              * Don't generate upvars on the left side of a for loop. See
+              * bug 470758.
+              */
+             if (cg->flags & TCF_IN_FOR_INIT)
+                 return JS_TRUE;
              JS_ASSERT(caller->script);
-             if (!caller->fun || caller->varobj != tc->u.scopeChain)
+             if (!caller->fun)
+                 return JS_TRUE;
+             /*
+              * Make sure the variable object used by the compiler to initialize
+              * parent links matches the caller's varobj. Compile-n-go compiler-
+              * created function objects have the top-level cg's scopeChain set
+              * as their parent by JSCompiler::newFunction.
+              */
+             JSObject *scopeobj = (cg->flags & TCF_IN_FUNCTION)
+                                  ? STOBJ_GET_PARENT(FUN_OBJECT(cg->fun))
+                                  : cg->scopeChain;
+             if (scopeobj != caller->varobj)
                  return JS_TRUE;
              /*
               * We are compiling eval or debug script inside a function frame
-              * and the scope chain matches function's variable object.
+              * and the scope chain matches the function's variable object.
               * Optimize access to function's arguments and variable and the
               * arguments object.
               */
-             if (PN_OP(pn) != JSOP_NAME || cg->staticDepth > JS_DISPLAY_SIZE)
+             if (op != JSOP_NAME)
-                 goto arguments_check;
+                 return JS_TRUE;
-             localKind = js_LookupLocal(cx, caller->fun, atom, &index);
-             if (localKind == JSLOCAL_NONE)
-                 goto arguments_check;
-             ATOM_LIST_SEARCH(ale, &cg->upvarList, atom);
-             if (!ale) {
-                 uint32 length, *vector;
-                 ale = js_IndexAtom(cx, atom, &cg->upvarList);
-                 if (!ale)
-                     return JS_FALSE;
-                 JS_ASSERT(ALE_INDEX(ale) == cg->upvarList.count - 1);
-                 length = cg->upvarMap.length;
-                 JS_ASSERT(ALE_INDEX(ale) <= length);
-                 if (ALE_INDEX(ale) == length) {
-                     length = 2 * JS_MAX(2, length);
-                     vector = (uint32 *)
-                              JS_realloc(cx, cg->upvarMap.vector,
-                                         length * sizeof *vector);
-                     if (!vector)
-                         return JS_FALSE;
-                     cg->upvarMap.vector = vector;
-                     cg->upvarMap.length = length;
-                 }
-                 if (localKind != JSLOCAL_ARG)
-                     index += caller->fun->nargs;
-                 if (index >= JS_BIT(16)) {
-                     cg->treeContext.flags |= TCF_FUN_USES_NONLOCALS;
-                     return JS_TRUE;
-                 }
-                 JS_ASSERT(cg->staticDepth > caller->fun->u.i.script->staticDepth);
-                 uintN skip = cg->staticDepth - caller->fun->u.i.script->staticDepth;
-                 cg->upvarMap.vector[ALE_INDEX(ale)] = MAKE_UPVAR_COOKIE(skip, index);
-             }
-             pn->pn_op = JSOP_GETUPVAR;
+             return MakeUpvarForEval(pn, cg);
-             pn->pn_slot = ALE_INDEX(ale);
-             return JS_TRUE;
          }
+         return JS_TRUE;
+     }
+     if (dn->pn_dflags & PND_GVAR) {
          /*
-          * We are optimizing global variables and there may be no pre-existing
+          * If this is a global reference from within a function, leave pn_op as
-          * global property named atom.  If atom was declared via const or var,
+          * JSOP_NAME, etc. We could emit JSOP_*GVAR ops within function code if
-          * optimize pn to access fp->vars using the appropriate JSOP_*GVAR op.
+          * only we could depend on the global frame's slots being valid for all
+          * calls to the function.
           */
-         ATOM_LIST_SEARCH(ale, &tc->decls, atom);
+         if (cg->flags & TCF_IN_FUNCTION)
-         if (!ale) {
-             /* Use precedes declaration, or name is never declared. */
-             return JS_TRUE;
-         }
-         constOp = (ALE_JSOP(ale) == JSOP_DEFCONST);
-         /* Index atom so we can map fast global number to name. */
-         ale = js_IndexAtom(cx, atom, &cg->atomList);
-         if (!ale)
-             return JS_FALSE;
-         /* Defend against tc->ngvars 16-bit overflow. */
-         slot = ALE_INDEX(ale);
-         if ((slot + 1) >> 16)
              return JS_TRUE;
-         if ((uint16)(slot + 1) > tc->ngvars)
+         /*
-             tc->ngvars = (uint16)(slot + 1);
+          * We are optimizing global variables and there may be no pre-existing
+          * global property named atom when this global script runs. If atom was
+          * declared via const or var, optimize pn to access fp->vars using the
+          * appropriate JSOP_*GVAR op.
+          *
+          * FIXME: should be able to optimize global function access too.
+          */
+         JS_ASSERT(dn_kind == JSDefinition::VAR || dn_kind == JSDefinition::CONST);
-         op = PN_OP(pn);
          switch (op) {
            case JSOP_NAME:     op = JSOP_GETGVAR; break;
            case JSOP_SETNAME:  op = JSOP_SETGVAR; break;
-Line 1967
+Line 2090
            case JSOP_DELNAME:  /* NB: no change */ break;
            default: JS_NOT_REACHED("gvar");
          }
-         pn->pn_const = constOp;
+         pn->pn_op = op;
-         if (op != pn->pn_op) {
+         pn->pn_cookie = cookie;
-             pn->pn_op = op;
+         pn->pn_dflags |= PND_BOUND;
-             pn->pn_slot = slot;
-         }
          return JS_TRUE;
      }
-     if (tc->flags & TCF_IN_FUNCTION) {
+     uintN level = UPVAR_FRAME_SKIP(cookie);
+     JS_ASSERT(cg->staticLevel >= level);
+     /*
+      * A JSDefinition witnessed as a declaration by the parser cannot be an
+      * upvar, unless it is the degenerate kind of upvar selected above (in the
+      * code before the PND_GVAR test) for the special case of compile-and-go
+      * code generated from eval called from a function, where the eval code
+      * uses local vars defined in the function. We detect this upvar-for-eval
+      * case by checking dn's op.
+      */
+     if (PN_OP(dn) == JSOP_GETUPVAR) {
+         JS_ASSERT(cg->staticLevel >= level);
+         if (op != JSOP_NAME)
+             return JS_TRUE;
+ #ifdef DEBUG
+         JSStackFrame *caller = cg->compiler->callerFrame;
+         JS_ASSERT(caller);
+         JSTreeContext *tc = cg;
+         while (tc->staticLevel != level)
+             tc = tc->parent;
+         JS_ASSERT(tc->flags & TCF_COMPILING);
+         JSCodeGenerator *evalcg = (JSCodeGenerator *) tc;
+         JS_ASSERT(evalcg->flags & TCF_COMPILE_N_GO);
+         JS_ASSERT(!(evalcg->flags & TCF_IN_FOR_INIT));
+         JS_ASSERT(caller->script);
+         JS_ASSERT(caller->fun && caller->varobj == evalcg->scopeChain);
+ #endif
+         if (cg->staticLevel == level) {
+             pn->pn_op = JSOP_GETUPVAR;
+             pn->pn_cookie = cookie;
+             pn->pn_dflags |= PND_BOUND;
+             return JS_TRUE;
+         }
+         return MakeUpvarForEval(pn, cg);
+     }
+     uintN skip = cg->staticLevel - level;
+     if (skip != 0) {
+         JS_ASSERT(cg->flags & TCF_IN_FUNCTION);
+         JS_ASSERT(cg->lexdeps.lookup(atom));
+         JS_ASSERT(JOF_OPTYPE(op) == JOF_ATOM);
+         JS_ASSERT(cg->fun->u.i.skipmin <= skip);
          /*
-          * We are compiling a function body and may be able to optimize name
+          * If op is a mutating opcode, this upvar's static level is too big to
-          * to stack slot. Look for an argument or variable in the function and
+          * index into the display, or the function is heavyweight, we fall back
-          * rewrite pn_op and update pn accordingly.
+          * on JSOP_*NAME*.
           */
-         localKind = js_LookupLocal(cx, tc->u.fun, atom, &index);
+         if (op != JSOP_NAME)
-         if (localKind != JSLOCAL_NONE) {
+             return JS_TRUE;
-             op = PN_OP(pn);
+         if (level >= JS_DISPLAY_SIZE)
-             if (localKind == JSLOCAL_ARG) {
+             return JS_TRUE;
-                 switch (op) {
+         if (cg->flags & TCF_FUN_HEAVYWEIGHT)
-                   case JSOP_NAME:     op = JSOP_GETARG; break;
+             return JS_TRUE;
-                   case JSOP_SETNAME:  op = JSOP_SETARG; break;
-                   case JSOP_INCNAME:  op = JSOP_INCARG; break;
+         if (FUN_FLAT_CLOSURE(cg->fun)) {
-                   case JSOP_NAMEINC:  op = JSOP_ARGINC; break;
+             op = JSOP_GETDSLOT;
-                   case JSOP_DECNAME:  op = JSOP_DECARG; break;
+         } else {
-                   case JSOP_NAMEDEC:  op = JSOP_ARGDEC; break;
+             /*
-                   case JSOP_FORNAME:  op = JSOP_FORARG; break;
+              * The function we're compiling may not be heavyweight, but if it
-                   case JSOP_DELNAME:  op = JSOP_FALSE; break;
+              * escapes as a funarg, we can't use JSOP_GETUPVAR/JSOP_CALLUPVAR.
-                   default: JS_NOT_REACHED("arg");
+              * JSCompiler::analyzeFunctions has arranged for this function's
-                 }
+              * enclosing functions to be heavyweight, so we can safely stick
-                 pn->pn_const = JS_FALSE;
+              * with JSOP_NAME/JSOP_CALLNAME.
-             } else {
+              */
-                 JS_ASSERT(localKind == JSLOCAL_VAR ||
+             if (cg->funbox->node->pn_dflags & PND_FUNARG)
-                           localKind == JSLOCAL_CONST);
+                 return JS_TRUE;
-                 switch (op) {
-                   case JSOP_NAME:     op = JSOP_GETLOCAL; break;
+             /*
-                   case JSOP_SETNAME:  op = JSOP_SETLOCAL; break;
+              * Generator functions may be resumed from any call stack, which
-                   case JSOP_SETCONST: op = JSOP_SETLOCAL; break;
+              * defeats the display optimization to static link searching used
-                   case JSOP_INCNAME:  op = JSOP_INCLOCAL; break;
+              * by JSOP_{GET,CALL}UPVAR.
-                   case JSOP_NAMEINC:  op = JSOP_LOCALINC; break;
+              */
-                   case JSOP_DECNAME:  op = JSOP_DECLOCAL; break;
+             if (cg->flags & TCF_FUN_IS_GENERATOR)
-                   case JSOP_NAMEDEC:  op = JSOP_LOCALDEC; break;
+                 return JS_TRUE;
-                   case JSOP_FORNAME:  op = JSOP_FORLOCAL; break;
-                   case JSOP_DELNAME:  op = JSOP_FALSE; break;
+             op = JSOP_GETUPVAR;
-                   default: JS_NOT_REACHED("local");
+         }
+         ale = cg->upvarList.lookup(atom);
+         if (ale) {
+             index = ALE_INDEX(ale);
+         } else {
+             if (!js_AddLocal(cx, cg->fun, atom, JSLOCAL_UPVAR))
+                 return JS_FALSE;
+             ale = cg->upvarList.add(cg->compiler, atom);
+             if (!ale)
+                 return JS_FALSE;
+             index = ALE_INDEX(ale);
+             JS_ASSERT(index == cg->upvarList.count - 1);
+             uint32 *vector = cg->upvarMap.vector;
+             if (!vector) {
+                 uint32 length = cg->lexdeps.count;
+                 vector = (uint32 *) calloc(length, sizeof *vector);
+                 if (!vector) {
+                     JS_ReportOutOfMemory(cx);
+                     return JS_FALSE;
                  }
-                 pn->pn_const = (localKind == JSLOCAL_CONST);
+                 cg->upvarMap.vector = vector;
+                 cg->upvarMap.length = length;
              }
-             pn->pn_op = op;
-             pn->pn_slot = index;
+             uintN slot = UPVAR_FRAME_SLOT(cookie);
-             return JS_TRUE;
+             if (dn_kind != JSDefinition::ARG) {
+                 JSTreeContext *tc = cg;
+                 do {
+                     tc = tc->parent;
+                 } while (tc->staticLevel != level);
+                 if (tc->flags & TCF_IN_FUNCTION)
+                     slot += tc->fun->nargs;
+             }
+             vector[index] = MAKE_UPVAR_COOKIE(skip, slot);
          }
-         tc->flags |= TCF_FUN_USES_NONLOCALS;
+         pn->pn_op = op;
+         pn->pn_cookie = index;
+         pn->pn_dflags |= PND_BOUND;
+         return JS_TRUE;
      }
-   arguments_check:
      /*
-      * Here we either compiling a function body or an eval or debug script
+      * We are compiling a function body and may be able to optimize name
-      * inside a function and couldn't optimize pn, so it's not a global or
+      * to stack slot. Look for an argument or variable in the function and
-      * local slot name. We are also outside of any with blocks. Check if we
+      * rewrite pn_op and update pn accordingly.
-      * can optimize the predefined arguments variable.
       */
-     JS_ASSERT((tc->flags & TCF_IN_FUNCTION) ||
+     switch (dn_kind) {
-               (tc->parseContext->callerFrame &&
+       case JSDefinition::UNKNOWN:
-                tc->parseContext->callerFrame->fun &&
-                tc->parseContext->callerFrame->varobj == tc->u.scopeChain));
-     if (pn->pn_op == JSOP_NAME &&
-         atom == cx->runtime->atomState.argumentsAtom) {
-         pn->pn_op = JSOP_ARGUMENTS;
          return JS_TRUE;
+       case JSDefinition::LET:
+         switch (op) {
+           case JSOP_NAME:     op = JSOP_GETLOCAL; break;
+           case JSOP_SETNAME:  op = JSOP_SETLOCAL; break;
+           case JSOP_INCNAME:  op = JSOP_INCLOCAL; break;
+           case JSOP_NAMEINC:  op = JSOP_LOCALINC; break;
+           case JSOP_DECNAME:  op = JSOP_DECLOCAL; break;
+           case JSOP_NAMEDEC:  op = JSOP_LOCALDEC; break;
+           case JSOP_FORNAME:  op = JSOP_FORLOCAL; break;
+           default: JS_NOT_REACHED("let");
+         }
+         break;
+       case JSDefinition::ARG:
+         switch (op) {
+           case JSOP_NAME:     op = JSOP_GETARG; break;
+           case JSOP_SETNAME:  op = JSOP_SETARG; break;
+           case JSOP_INCNAME:  op = JSOP_INCARG; break;
+           case JSOP_NAMEINC:  op = JSOP_ARGINC; break;
+           case JSOP_DECNAME:  op = JSOP_DECARG; break;
+           case JSOP_NAMEDEC:  op = JSOP_ARGDEC; break;
+           case JSOP_FORNAME:  op = JSOP_FORARG; break;
+           default: JS_NOT_REACHED("arg");
+         }
+         JS_ASSERT(!pn->isConst());
+         break;
+       case JSDefinition::VAR:
+         if (PN_OP(dn) == JSOP_CALLEE) {
+             JS_ASSERT(op != JSOP_CALLEE);
+             JS_ASSERT((cg->fun->flags & JSFUN_LAMBDA) && atom == cg->fun->atom);
+             switch (op) {
+               default:
+                 /*
+                  * Leave pn->pn_op == JSOP_NAME if cg->fun is heavyweight, as
+                  * we cannot be sure cg->fun is not something of the form:
+                  *
+                  *   var ff = (function f(s) { eval(s); return f; });
+                  *
+                  * where a caller invokes ff("var f = 42"). The result returned
+                  * for such an invocation must be 42, since the callee name is
+                  * lexically bound in an outer declarative environment from the
+                  * function's activation. See jsfun.cpp:call_resolve.
+                  */
+                 JS_ASSERT(op != JSOP_DELNAME);
+                 if (!(cg->flags & TCF_FUN_HEAVYWEIGHT)) {
+                     op = JSOP_CALLEE;
+                     pn->pn_dflags |= PND_CONST;
+                 }
+                 break;
+             }
+             pn->pn_op = op;
+             pn->pn_dflags |= PND_BOUND;
+             return JS_TRUE;
+         }
+         /* FALL THROUGH */
+       default:
+         JS_ASSERT_IF(dn_kind != JSDefinition::FUNCTION,
+                      dn_kind == JSDefinition::VAR ||
+                      dn_kind == JSDefinition::CONST);
+         switch (op) {
+           case JSOP_NAME:     op = JSOP_GETLOCAL; break;
+           case JSOP_SETNAME:  op = JSOP_SETLOCAL; break;
+           case JSOP_SETCONST: op = JSOP_SETLOCAL; break;
+           case JSOP_INCNAME:  op = JSOP_INCLOCAL; break;
+           case JSOP_NAMEINC:  op = JSOP_LOCALINC; break;
+           case JSOP_DECNAME:  op = JSOP_DECLOCAL; break;
+           case JSOP_NAMEDEC:  op = JSOP_LOCALDEC; break;
+           case JSOP_FORNAME:  op = JSOP_FORLOCAL; break;
+           default: JS_NOT_REACHED("local");
+         }
+         JS_ASSERT_IF(dn_kind == JSDefinition::CONST, pn->pn_dflags & PND_CONST);
+         break;
      }
+     JS_ASSERT(op != PN_OP(pn));
+     pn->pn_op = op;
+     pn->pn_cookie = UPVAR_FRAME_SLOT(cookie);
+     pn->pn_dflags |= PND_BOUND;
      return JS_TRUE;
  }
-Line 2057
+Line 2336
                   JSBool *answer)
  {
      JSBool ok;
-     JSFunction *fun;
      JSParseNode *pn2;
      ok = JS_TRUE;
-Line 2067
+Line 2345
      switch (pn->pn_arity) {
        case PN_FUNC:
          /*
-          * A named function is presumed useful: we can't yet know that it is
+          * A named function, contrary to ES3, is no longer useful, because we
-          * not called.  The side effects are the creation of a scope object
+          * bind its name lexically (using JSOP_CALLEE) instead of creating an
-          * to parent this function object, and the binding of the function's
+          * Object instance and binding a readonly, permanent property in it
-          * name in that scope object.  See comments at case JSOP_NAMEDFUNOBJ:
+          * (the object and binding can be detected and hijacked or captured).
-          * in jsinterp.c.
+          * This is a bug fix to ES3; it is fixed in ES3.1 drafts.
           */
-         fun = (JSFunction *) pn->pn_funpob->object;
+         *answer = JS_FALSE;
-         if (fun->atom)
-             *answer = JS_TRUE;
          break;
        case PN_LIST:
-Line 2134
+Line 2410
                      return JS_FALSE;
                  if (!CheckSideEffects(cx, cg, pn->pn_right, answer))
                      return JS_FALSE;
-                 if (!*answer &&
+                 if (!*answer && (pn->pn_op != JSOP_NOP || !pn2->isConst()))
-                     (pn->pn_op != JSOP_NOP ||
-                      pn2->pn_slot < 0 ||
-                      !pn2->pn_const)) {
                      *answer = JS_TRUE;
-                 }
              }
          } else {
              if (pn->pn_op == JSOP_OR || pn->pn_op == JSOP_AND ||
-Line 2170
+Line 2442
              pn2 = pn->pn_kid;
              switch (pn2->pn_type) {
                case TOK_NAME:
+                 if (!BindNameToSlot(cx, cg, pn2))
+                     return JS_FALSE;
+                 if (pn2->isConst()) {
+                     *answer = JS_FALSE;
+                     break;
+                 }
+                 /* FALL THROUGH */
                case TOK_DOT:
  #if JS_HAS_XML_SUPPORT
                case TOK_DBLDOT:
-Line 2216
+Line 2495
          if (pn->pn_type == TOK_NAME && pn->pn_op != JSOP_NOP) {
              if (!BindNameToSlot(cx, cg, pn))
                  return JS_FALSE;
-             if (pn->pn_slot < 0 && pn->pn_op != JSOP_ARGUMENTS) {
+             if (pn->pn_op != JSOP_ARGUMENTS && pn->pn_op != JSOP_CALLEE &&
+                 pn->pn_cookie == FREE_UPVAR_COOKIE) {
                  /*
-                  * Not an argument or local variable use, so this expression
+                  * Not an argument or local variable use, and not a use of a
-                  * could invoke a getter that has side effects.
+                  * unshadowed named function expression's given name, so this
+                  * expression could invoke a getter that has side effects.
                   */
                  *answer = JS_TRUE;
              }
          }
-         pn2 = pn->pn_expr;
+         pn2 = pn->maybeExpr();
          if (pn->pn_type == TOK_DOT) {
              if (pn2->pn_type == TOK_NAME && !BindNameToSlot(cx, cg, pn2))
                  return JS_FALSE;
-Line 2240
+Line 2521
          ok = CheckSideEffects(cx, cg, pn2, answer);
          break;
+       case PN_NAMESET:
+         ok = CheckSideEffects(cx, cg, pn->pn_tree, answer);
+         break;
        case PN_NULLARY:
          if (pn->pn_type == TOK_DEBUGGER)
              *answer = JS_TRUE;
-Line 2275
+Line 2560
            case JSOP_GETUPVAR:
              op = JSOP_CALLUPVAR;
              break;
+           case JSOP_GETDSLOT:
+             op = JSOP_CALLDSLOT;
+             break;
            default:
-             JS_ASSERT(op == JSOP_ARGUMENTS);
+             JS_ASSERT(op == JSOP_ARGUMENTS || op == JSOP_CALLEE);
              break;
          }
      }
-     if (op == JSOP_ARGUMENTS) {
+     if (op == JSOP_ARGUMENTS || op == JSOP_CALLEE) {
          if (js_Emit1(cx, cg, op) < 0)
              return JS_FALSE;
          if (callContext && js_Emit1(cx, cg, JSOP_NULL) < 0)
              return JS_FALSE;
      } else {
-         if (pn->pn_slot >= 0) {
+         if (pn->pn_cookie != FREE_UPVAR_COOKIE) {
-             EMIT_UINT16_IMM_OP(op, pn->pn_slot);
+             EMIT_UINT16_IMM_OP(op, pn->pn_cookie);
          } else {
              if (!EmitAtomOp(cx, pn, op, cg))
                  return JS_FALSE;
-Line 2310
+Line 2598
      JS_ASSERT(op == JSOP_XMLNAME || op == JSOP_CALLXMLNAME);
      pn2 = pn->pn_kid;
-     oldflags = cg->treeContext.flags;
+     oldflags = cg->flags;
-     cg->treeContext.flags &= ~TCF_IN_FOR_INIT;
+     cg->flags &= ~TCF_IN_FOR_INIT;
      if (!js_EmitTree(cx, cg, pn2))
          return JS_FALSE;
-     cg->treeContext.flags |= oldflags & TCF_IN_FOR_INIT;
+     cg->flags |= oldflags & TCF_IN_FOR_INIT;
      if (js_NewSrcNote2(cx, cg, SRC_PCBASE,
                         CG_OFFSET(cg) - pn2->pn_offset) < 0) {
          return JS_FALSE;
-Line 2325
+Line 2613
  #endif
  static JSBool
+ EmitSpecialPropOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg)
+ {
+     /*
+      * Special case for obj.__proto__, obj.__parent__, obj.__count__ to
+      * deoptimize away from fast paths in the interpreter and trace recorder,
+      * which skip dense array instances by going up to Array.prototype before
+      * looking up the property name.
+      */
+     JSAtomListElement *ale = cg->atomList.add(cg->compiler, pn->pn_atom);
+     if (!ale)
+         return JS_FALSE;
+     if (!EmitIndexOp(cx, JSOP_QNAMEPART, ALE_INDEX(ale), cg))
+         return JS_FALSE;
+     if (js_Emit1(cx, cg, op) < 0)
+         return JS_FALSE;
+     return JS_TRUE;
+ }
+ static JSBool
  EmitPropOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg,
             JSBool callContext)
  {
      JSParseNode *pn2, *pndot, *pnup, *pndown;
      ptrdiff_t top;
-     pn2 = pn->pn_expr;
+     JS_ASSERT(pn->pn_arity == PN_NAME);
+     pn2 = pn->maybeExpr();
+     /* Special case deoptimization on __proto__, __count__ and __parent__. */
+     if ((op == JSOP_GETPROP || op == JSOP_CALLPROP) &&
+         (pn->pn_atom == cx->runtime->atomState.protoAtom ||
+          pn->pn_atom == cx->runtime->atomState.parentAtom ||
+          pn->pn_atom == cx->runtime->atomState.countAtom)) {
+         if (pn2 && !js_EmitTree(cx, cg, pn2))
+             return JS_FALSE;
+         return EmitSpecialPropOp(cx, pn, callContext ? JSOP_CALLELEM : JSOP_GETELEM, cg);
+     }
      if (callContext) {
          JS_ASSERT(pn->pn_type == TOK_DOT);
          JS_ASSERT(op == JSOP_GETPROP);
-Line 2367
+Line 2686
                          JSAtomListElement *ale;
                          jsatomid atomIndex;
-                         ale = js_IndexAtom(cx, pn->pn_atom, &cg->atomList);
+                         ale = cg->atomList.add(cg->compiler, pn->pn_atom);
                          if (!ale)
                              return JS_FALSE;
                          atomIndex = ALE_INDEX(ale);
-                         return EmitSlotIndexOp(cx, op, pn2->pn_slot, atomIndex, cg);
+                         return EmitSlotIndexOp(cx, op, pn2->pn_cookie, atomIndex, cg);
                      }
                    default:;
-Line 2392
+Line 2711
          for (;;) {
              /* Reverse pndot->pn_expr to point up, not down. */
              pndot->pn_offset = top;
+             JS_ASSERT(!pndot->pn_used);
              pndown = pndot->pn_expr;
              pndot->pn_expr = pnup;
              if (pndown->pn_type != TOK_DOT)
-Line 2410
+Line 2730
                                 CG_OFFSET(cg) - pndown->pn_offset) < 0) {
                  return JS_FALSE;
              }
-             if (!EmitAtomOp(cx, pndot, PN_OP(pndot), cg))
+             /*
+              * Special case deoptimization on __proto__, __count__ and
+              * __parent__, as above.
+              */
+             if (pndot->pn_arity == PN_NAME &&
+                 (pndot->pn_atom == cx->runtime->atomState.protoAtom ||
+                  pndot->pn_atom == cx->runtime->atomState.parentAtom ||
+                  pndot->pn_atom == cx->runtime->atomState.countAtom)) {
+                 if (!EmitSpecialPropOp(cx, pndot, JSOP_GETELEM, cg))
+                     return JS_FALSE;
+             } else if (!EmitAtomOp(cx, pndot, PN_OP(pndot), cg)) {
                  return JS_FALSE;
+             }
              /* Reverse the pn_expr link again. */
              pnup = pndot->pn_expr;
-Line 2444
+Line 2776
          JS_ASSERT(pn->pn_op == JSOP_GETELEM);
          JS_ASSERT(pn->pn_count >= 3);
          left = pn->pn_head;
-         right = PN_LAST(pn);
+         right = pn->last();
          next = left->pn_next;
          JS_ASSERT(next != right);
-Line 2500
+Line 2832
               * the base expression (pn_expr) of the name may be null, which
               * means we have to emit a JSOP_BINDNAME.
               */
-             left = pn->pn_expr;
+             left = pn->maybeExpr();
              if (!left) {
                  left = &ltmp;
                  left->pn_type = TOK_STRING;
-Line 2594
+Line 2926
      if (!atom)
          return JS_FALSE;
-     ale = js_IndexAtom(cx, atom, &cg->atomList);
+     ale = cg->atomList.add(cg->compiler, atom);
      if (!ale)
          return JS_FALSE;
      return EmitIndexOp(cx, JSOP_DOUBLE, ALE_INDEX(ale), cg);
-Line 2644
+Line 2976
           * the stack so that case-dispatch bytecodes can find the discriminant
           * on top of stack.
           */
-         count = OBJ_BLOCK_COUNT(cx, pn2->pn_pob->object);
+         count = OBJ_BLOCK_COUNT(cx, pn2->pn_objbox->object);
-         js_PushBlockScope(&cg->treeContext, stmtInfo, pn2->pn_pob->object, -1);
+         js_PushBlockScope(cg, stmtInfo, pn2->pn_objbox->object, -1);
          stmtInfo->type = STMT_SWITCH;
          /* Emit JSOP_ENTERBLOCK before code to evaluate the discriminant. */
-         if (!EmitObjectOp(cx, pn2->pn_pob, JSOP_ENTERBLOCK, cg))
+         if (!EmitEnterBlock(cx, pn2, cg))
              return JS_FALSE;
          /*
           * Pop the switch's statement info around discriminant code-gen.  Note
-          * how this leaves cg->treeContext.blockChain referencing the switch's
+          * how this leaves cg->blockChain referencing the switch's
           * block scope object, which is necessary for correct block parenting
           * in the case where the discriminant contains a let expression.
           */
-         cg->treeContext.topStmt = stmtInfo->down;
+         cg->topStmt = stmtInfo->down;
-         cg->treeContext.topScopeStmt = stmtInfo->downScope;
+         cg->topScopeStmt = stmtInfo->downScope;
      }
  #ifdef __GNUC__
      else {
-Line 2678
+Line 3010
      /* Switch bytecodes run from here till end of final case. */
      top = CG_OFFSET(cg);
  #if !JS_HAS_BLOCK_SCOPE
-     js_PushStatement(&cg->treeContext, stmtInfo, STMT_SWITCH, top);
+     js_PushStatement(cg, stmtInfo, STMT_SWITCH, top);
  #else
      if (pn2->pn_type == TOK_LC) {
-         js_PushStatement(&cg->treeContext, stmtInfo, STMT_SWITCH, top);
+         js_PushStatement(cg, stmtInfo, STMT_SWITCH, top);
      } else {
          /* Re-push the switch's statement info record. */
-         cg->treeContext.topStmt = cg->treeContext.topScopeStmt = stmtInfo;
+         cg->topStmt = cg->topScopeStmt = stmtInfo;
          /* Set the statement info record's idea of top. */
          stmtInfo->update = top;
          /* Advance pn2 to refer to the switch case list. */
-         pn2 = pn2->pn_expr;
+         pn2 = pn2->expr();
      }
  #endif
-Line 2725
+Line 3057
                  continue;
              pn4 = pn3->pn_left;
+             while (pn4->pn_type == TOK_RP)
+                 pn4 = pn4->pn_kid;
              switch (pn4->pn_type) {
                case TOK_NUMBER:
                  d = pn4->pn_dval;
-Line 2743
+Line 3077
                  pn3->pn_val = ATOM_KEY(pn4->pn_atom);
                  break;
                case TOK_NAME:
-                 if (!pn4->pn_expr) {
+                 if (!pn4->maybeExpr()) {
                      ok = LookupCompileTimeConstant(cx, cg, pn4->pn_atom, &v);
                      if (!ok)
                          goto release;
-Line 3027
+Line 3361
                          (pn4 = pn3->pn_left) != NULL &&
                          pn4->pn_type == TOK_NAME) {
                          /* Note a propagated constant with the const's name. */
-                         JS_ASSERT(!pn4->pn_expr);
+                         JS_ASSERT(!pn4->maybeExpr());
-                         ale = js_IndexAtom(cx, pn4->pn_atom, &cg->atomList);
+                         ale = cg->atomList.add(cg->compiler, pn4->pn_atom);
                          if (!ale)
                              goto bad;
                          CG_NEXT(cg) = pc;
-Line 3044
+Line 3378
                      pn4 = pn3->pn_left;
                      if (pn4 && pn4->pn_type == TOK_NAME) {
                          /* Note a propagated constant with the const's name. */
-                         JS_ASSERT(!pn4->pn_expr);
+                         JS_ASSERT(!pn4->maybeExpr());
-                         ale = js_IndexAtom(cx, pn4->pn_atom, &cg->atomList);
+                         ale = cg->atomList.add(cg->compiler, pn4->pn_atom);
                          if (!ale)
                              goto bad;
                          CG_NEXT(cg) = pc;
-Line 3126
+Line 3460
                  continue;
              if (!js_AtomizePrimitiveValue(cx, pn3->pn_val, &atom))
                  goto bad;
-             ale = js_IndexAtom(cx, atom, &cg->atomList);
+             ale = cg->atomList.add(cg->compiler, atom);
              if (!ale)
                  goto bad;
              SET_INDEX(pc, ALE_INDEX(ale));
-Line 3161
+Line 3495
  JSBool
  js_EmitFunctionScript(JSContext *cx, JSCodeGenerator *cg, JSParseNode *body)
  {
-     if (cg->treeContext.flags & TCF_FUN_IS_GENERATOR) {
+     if (cg->flags & TCF_FUN_IS_GENERATOR) {
          /* JSOP_GENERATOR must be the first instruction. */
          CG_SWITCH_TO_PROLOG(cg);
          JS_ASSERT(CG_NEXT(cg) == CG_BASE(cg));
-Line 3176
+Line 3510
  }
  /* A macro for inlining at the top of js_EmitTree (whence it came). */
- #define UPDATE_LINE_NUMBER_NOTES(cx, cg, pn)                                  \
+ #define UPDATE_LINE_NUMBER_NOTES(cx, cg, line)                                \
      JS_BEGIN_MACRO                                                            \
-         uintN line_ = (pn)->pn_pos.begin.lineno;                              \
+         uintN line_ = (line);                                                 \
          uintN delta_ = line_ - CG_CURRENT_LINE(cg);                           \
          if (delta_ != 0) {                                                    \
              /*                                                                \
-Line 3207
+Line 3541
  /* A function, so that we avoid macro-bloating all the other callsites. */
  static JSBool
- UpdateLineNumberNotes(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
+ UpdateLineNumberNotes(JSContext *cx, JSCodeGenerator *cg, uintN line)
  {
-     UPDATE_LINE_NUMBER_NOTES(cx, cg, pn);
+     UPDATE_LINE_NUMBER_NOTES(cx, cg, line);
      return JS_TRUE;
  }
-Line 3220
+Line 3554
      jsatomid atomIndex;
      JSAtomListElement *ale;
-     if (pn->pn_slot >= 0) {
+     if (pn->pn_cookie != FREE_UPVAR_COOKIE) {
-         atomIndex = (jsatomid) pn->pn_slot;
+         atomIndex = (jsatomid) UPVAR_FRAME_SLOT(pn->pn_cookie);
      } else {
-         ale = js_IndexAtom(cx, pn->pn_atom, &cg->atomList);
+         ale = cg->atomList.add(cg->compiler, pn->pn_atom);
          if (!ale)
              return JS_FALSE;
          atomIndex = ALE_INDEX(ale);
      }
      if (JOF_OPTYPE(pn->pn_op) == JOF_ATOM &&
-         (!(cg->treeContext.flags & TCF_IN_FUNCTION) ||
+         (!(cg->flags & TCF_IN_FUNCTION) || (cg->flags & TCF_FUN_HEAVYWEIGHT))) {
-          (cg->treeContext.flags & TCF_FUN_HEAVYWEIGHT))) {
-         /* Emit a prolog bytecode to predefine the variable. */
          CG_SWITCH_TO_PROLOG(cg);
-         if (!UpdateLineNumberNotes(cx, cg, pn))
+         if (!UpdateLineNumberNotes(cx, cg, pn->pn_pos.begin.lineno))
              return JS_FALSE;
          EMIT_INDEX_OP(prologOp, atomIndex);
          CG_SWITCH_TO_MAIN(cg);
-Line 3259
+Line 3591
      if (!BindNameToSlot(cx, cg, pn))
          return JS_FALSE;
-     JS_ASSERT(pn->pn_op != JSOP_ARGUMENTS);
+     JS_ASSERT(PN_OP(pn) != JSOP_ARGUMENTS && PN_OP(pn) != JSOP_CALLEE);
      return MaybeEmitVarDecl(cx, cg, prologOp, pn, NULL);
  }
-Line 3318
+Line 3650
          if (js_Emit1(cx, cg, JSOP_POP) < 0)
              return JS_FALSE;
      } else {
-         if (pn->pn_type == TOK_NAME && !BindNameToSlot(cx, cg, pn))
+         if (pn->pn_type == TOK_NAME) {
-             return JS_FALSE;
+             if (!BindNameToSlot(cx, cg, pn))
+                 return JS_FALSE;
+             if (pn->isConst() && !pn->isInitialized())
+                 return js_Emit1(cx, cg, JSOP_POP) >= 0;
+         }
          switch (pn->pn_op) {
            case JSOP_SETNAME:
-Line 3338
+Line 3674
              break;
            case JSOP_SETLOCAL:
-             slot = (jsuint) pn->pn_slot;
+             slot = (jsuint) pn->pn_cookie;
              EMIT_UINT16_IMM_OP(JSOP_SETLOCALPOP, slot);
              break;
            case JSOP_SETARG:
            case JSOP_SETGVAR:
-             slot = (jsuint) pn->pn_slot;
+             slot = (jsuint) pn->pn_cookie;
              EMIT_UINT16_IMM_OP(PN_OP(pn), slot);
              if (js_Emit1(cx, cg, JSOP_POP) < 0)
                  return JS_FALSE;
-Line 3404
+Line 3740
      for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
          /*
           * Duplicate the value being destructured to use as a reference base.
+          * If dup is not the first one, annotate it for the decompiler.
           */
+         if (pn2 != pn->pn_head && js_NewSrcNote(cx, cg, SRC_CONTINUE) < 0)
+             return JS_FALSE;
          if (js_Emit1(cx, cg, JSOP_DUP) < 0)
              return JS_FALSE;
-Line 3488
+Line 3827
  }
  static JSBool
- EmitDestructuringOps(JSContext *cx, JSCodeGenerator *cg, JSOp declOp,
+ EmitDestructuringOps(JSContext *cx, JSCodeGenerator *cg, JSOp prologOp,
                       JSParseNode *pn)
  {
      /*
-Line 3497
+Line 3836
       * If the destructuring initialiser is empty, our helper will emit a
       * JSOP_DUP followed by a JSOP_POP for the decompiler.
       */
-     if (js_NewSrcNote2(cx, cg, SRC_DESTRUCT, OpToDeclType(declOp)) < 0)
+     if (js_NewSrcNote2(cx, cg, SRC_DESTRUCT, OpToDeclType(prologOp)) < 0)
          return JS_FALSE;
      /*
-Line 3508
+Line 3847
  }
  static JSBool
- EmitGroupAssignment(JSContext *cx, JSCodeGenerator *cg, JSOp declOp,
+ EmitGroupAssignment(JSContext *cx, JSCodeGenerator *cg, JSOp prologOp,
                      JSParseNode *lhs, JSParseNode *rhs)
  {
      jsuint depth, limit, i, nslots;
-Line 3522
+Line 3861
              return JS_FALSE;
          }
-         if (pn->pn_type == TOK_COMMA) {
+         /* MaybeEmitGroupAssignment won't call us if rhs is holey. */
-             if (js_Emit1(cx, cg, JSOP_PUSH) < 0)
+         JS_ASSERT(pn->pn_type != TOK_COMMA);
-                 return JS_FALSE;
+         if (!js_EmitTree(cx, cg, pn))
-         } else {
+             return JS_FALSE;
-             JS_ASSERT(pn->pn_type != TOK_DEFSHARP);
-             if (!js_EmitTree(cx, cg, pn))
-                 return JS_FALSE;
-         }
          ++limit;
      }
-     if (js_NewSrcNote2(cx, cg, SRC_GROUPASSIGN, OpToDeclType(declOp)) < 0)
+     if (js_NewSrcNote2(cx, cg, SRC_GROUPASSIGN, OpToDeclType(prologOp)) < 0)
          return JS_FALSE;
      i = depth;
      for (pn = lhs->pn_head; pn; pn = pn->pn_next, ++i) {
-         if (i < limit) {
+         /* MaybeEmitGroupAssignment requires lhs->pn_count <= rhs->pn_count. */
-             jsint slot;
+         JS_ASSERT(i < limit);
+         jsint slot = AdjustBlockSlot(cx, cg, i);
+         if (slot < 0)
+             return JS_FALSE;
+         EMIT_UINT16_IMM_OP(JSOP_GETLOCAL, slot);
-             slot = AdjustBlockSlot(cx, cg, i);
-             if (slot < 0)
-                 return JS_FALSE;
-             EMIT_UINT16_IMM_OP(JSOP_GETLOCAL, slot);
-         } else {
-             if (js_Emit1(cx, cg, JSOP_PUSH) < 0)
-                 return JS_FALSE;
-         }
          if (pn->pn_type == TOK_COMMA && pn->pn_arity == PN_NULLARY) {
              if (js_Emit1(cx, cg, JSOP_POP) < 0)
                  return JS_FALSE;
-Line 3570
+Line 3901
   * we set *pop to JSOP_NOP so callers can veto emitting pn followed by a pop.
   */
  static JSBool
- MaybeEmitGroupAssignment(JSContext *cx, JSCodeGenerator *cg, JSOp declOp,
+ MaybeEmitGroupAssignment(JSContext *cx, JSCodeGenerator *cg, JSOp prologOp,
                           JSParseNode *pn, JSOp *pop)
  {
      JSParseNode *lhs, *rhs;
-Line 3580
+Line 3911
      lhs = pn->pn_left;
      rhs = pn->pn_right;
      if (lhs->pn_type == TOK_RB && rhs->pn_type == TOK_RB &&
-         lhs->pn_count <= rhs->pn_count &&
+         !(rhs->pn_xflags & PNX_HOLEY) &&
-         (rhs->pn_count == 0 ||
+         lhs->pn_count <= rhs->pn_count) {
-          rhs->pn_head->pn_type != TOK_DEFSHARP)) {
+         if (!EmitGroupAssignment(cx, cg, prologOp, lhs, rhs))
-         if (!EmitGroupAssignment(cx, cg, declOp, lhs, rhs))
              return JS_FALSE;
          *pop = JSOP_NOP;
      }
-Line 3596
+Line 3926
  EmitVariables(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn,
                JSBool inLetHead, ptrdiff_t *headNoteIndex)
  {
-     JSTreeContext *tc;
+     bool let, forInVar, first;
-     JSBool let, forInVar;
  #if JS_HAS_BLOCK_SCOPE
-     JSBool forInLet, popScope;
+     bool forInLet, popScope;
      JSStmtInfo *stmt, *scopeStmt;
  #endif
      ptrdiff_t off, noteIndex, tmp;
-     JSParseNode *pn2, *pn3;
+     JSParseNode *pn2, *pn3, *next;
      JSOp op;
      jsatomid atomIndex;
      uintN oldflags;
-Line 3623
+Line 3952
       * to the start of the block, a 'for (let x = i...) ...' loop evaluates i
       * in the containing scope, and puts x in the loop body's scope.
       */
-     tc = &cg->treeContext;
      let = (pn->pn_op == JSOP_NOP);
-     forInVar = (pn->pn_extra & PNX_FORINVAR) != 0;
+     forInVar = (pn->pn_xflags & PNX_FORINVAR) != 0;
  #if JS_HAS_BLOCK_SCOPE
      forInLet = let && forInVar;
-     popScope = (inLetHead || (let && (tc->flags & TCF_IN_FOR_INIT)));
+     popScope = (inLetHead || (let && (cg->flags & TCF_IN_FOR_INIT)));
+     if (popScope) {
+         stmt = cg->topStmt;
+         scopeStmt = cg->topScopeStmt;
+     }
+ # ifdef __GNUC__
+     else stmt = scopeStmt = NULL;   /* quell GCC overwarning */
+ # endif
      JS_ASSERT(!popScope || let);
  #endif
      off = noteIndex = -1;
-     for (pn2 = pn->pn_head; ; pn2 = pn2->pn_next) {
+     for (pn2 = pn->pn_head; ; pn2 = next) {
- #if JS_HAS_DESTRUCTURING
+         first = pn2 == pn->pn_head;
+         next = pn2->pn_next;
          if (pn2->pn_type != TOK_NAME) {
+ #if JS_HAS_DESTRUCTURING
              if (pn2->pn_type == TOK_RB || pn2->pn_type == TOK_RC) {
                  /*
                   * Emit variable binding ops, but not destructuring ops.
-Line 3651
+Line 3989
                      return JS_FALSE;
                  break;
              }
+ #endif
              /*
               * A destructuring initialiser assignment preceded by var will
-Line 3660
+Line 3999
               */
              JS_ASSERT(pn2->pn_type == TOK_ASSIGN);
              JS_ASSERT(!forInVar);
+             /*
+              * To allow the front end to rewrite var f = x; as f = x; when a
+              * function f(){} precedes the var, detect simple name assignment
+              * here and initialize the name.
+              */
+ #if !JS_HAS_DESTRUCTURING
+             JS_ASSERT(pn2->pn_left->pn_type == TOK_NAME);
+ #else
+             if (pn2->pn_left->pn_type == TOK_NAME)
+ #endif
+             {
+                 pn3 = pn2->pn_right;
+                 pn2 = pn2->pn_left;
+                 goto do_name;
+             }
+ #if JS_HAS_DESTRUCTURING
              if (pn->pn_count == 1) {
                  /*
                   * If this is the only destructuring assignment in the list,
-Line 3675
+Line 4032
                      return JS_FALSE;
                  }
                  if (op == JSOP_NOP) {
-                     pn->pn_extra = (pn->pn_extra & ~PNX_POPVAR) | PNX_GROUPINIT;
+                     pn->pn_xflags = (pn->pn_xflags & ~PNX_POPVAR) | PNX_GROUPINIT;
                      break;
                  }
              }
-Line 3698
+Line 4055
                  return JS_FALSE;
              }
              goto emit_note_pop;
-         }
- #else
-         JS_ASSERT(pn2->pn_type == TOK_NAME);
  #endif
+         }
+         /*
+          * Load initializer early to share code above that jumps to do_name.
+          * NB: if this var redeclares an existing binding, then pn2 is linked
+          * on its definition's use-chain and pn_expr has been overlayed with
+          * pn_lexdef.
+          */
+         pn3 = pn2->maybeExpr();
+      do_name:
          if (!BindNameToSlot(cx, cg, pn2))
              return JS_FALSE;
-         JS_ASSERT(pn2->pn_slot >= 0 || !let);
          op = PN_OP(pn2);
          if (op == JSOP_ARGUMENTS) {
              /* JSOP_ARGUMENTS => no initializer */
-             JS_ASSERT(!pn2->pn_expr && !let);
+             JS_ASSERT(!pn3 && !let);
              pn3 = NULL;
  #ifdef __GNUC__
              atomIndex = 0;            /* quell GCC overwarning */
  #endif
          } else {
+             JS_ASSERT(op != JSOP_CALLEE);
+             JS_ASSERT(pn2->pn_cookie != FREE_UPVAR_COOKIE || !let);
              if (!MaybeEmitVarDecl(cx, cg, PN_OP(pn), pn2, &atomIndex))
                  return JS_FALSE;
-             pn3 = pn2->pn_expr;
              if (pn3) {
                  JS_ASSERT(!forInVar);
                  if (op == JSOP_SETNAME) {
-Line 3727
+Line 4091
                      EMIT_INDEX_OP(JSOP_BINDNAME, atomIndex);
                  }
                  if (pn->pn_op == JSOP_DEFCONST &&
-                     !js_DefineCompileTimeConstant(cx, cg, pn2->pn_atom,
+                     !js_DefineCompileTimeConstant(cx, cg, pn2->pn_atom, pn3)) {
-                                                   pn3)) {
                      return JS_FALSE;
                  }
  #if JS_HAS_BLOCK_SCOPE
                  /* Evaluate expr in the outer lexical scope if requested. */
                  if (popScope) {
-                     stmt = tc->topStmt;
+                     cg->topStmt = stmt->down;
-                     scopeStmt = tc->topScopeStmt;
+                     cg->topScopeStmt = scopeStmt->downScope;
-                     tc->topStmt = stmt->down;
-                     tc->topScopeStmt = scopeStmt->downScope;
                  }
- # ifdef __GNUC__
-                 else stmt = scopeStmt = NULL;   /* quell GCC overwarning */
- # endif
  #endif
-                 oldflags = cg->treeContext.flags;
+                 oldflags = cg->flags;
-                 cg->treeContext.flags &= ~TCF_IN_FOR_INIT;
+                 cg->flags &= ~TCF_IN_FOR_INIT;
                  if (!js_EmitTree(cx, cg, pn3))
                      return JS_FALSE;
-                 cg->treeContext.flags |= oldflags & TCF_IN_FOR_INIT;
+                 cg->flags |= oldflags & TCF_IN_FOR_INIT;
  #if JS_HAS_BLOCK_SCOPE
                  if (popScope) {
-                     tc->topStmt = stmt;
+                     cg->topStmt = stmt;
-                     tc->topScopeStmt = scopeStmt;
+                     cg->topScopeStmt = scopeStmt;
                  }
  #endif
              }
-Line 3769
+Line 4126
           * emit op or any source note. Our caller, the TOK_FOR/TOK_IN case in
           * js_EmitTree, will annotate appropriately.
           */
-         JS_ASSERT(pn3 == pn2->pn_expr);
+         JS_ASSERT_IF(pn2->pn_defn, pn3 == pn2->pn_expr);
          if (forInVar) {
              JS_ASSERT(pn->pn_count == 1);
              JS_ASSERT(!pn3);
              break;
          }
-         if (pn2 == pn->pn_head &&
+         if (first &&
              !inLetHead &&
              js_NewSrcNote2(cx, cg, SRC_DECL,
                             (pn->pn_op == JSOP_DEFCONST)
-Line 3789
+Line 4146
          if (op == JSOP_ARGUMENTS) {
              if (js_Emit1(cx, cg, op) < 0)
                  return JS_FALSE;
-         } else if (pn2->pn_slot >= 0) {
+         } else if (pn2->pn_cookie != FREE_UPVAR_COOKIE) {
              EMIT_UINT16_IMM_OP(op, atomIndex);
          } else {
              EMIT_INDEX_OP(op, atomIndex);
-Line 3803
+Line 4160
              if (!js_SetSrcNoteOffset(cx, cg, (uintN)noteIndex, 0, tmp-off))
                  return JS_FALSE;
          }
-         if (!pn2->pn_next)
+         if (!next)
              break;
          off = tmp;
          noteIndex = js_NewSrcNote2(cx, cg, SRC_PCDELTA, 0);
-Line 3816
+Line 4173
          *headNoteIndex = js_NewSrcNote(cx, cg, SRC_DECL);
          if (*headNoteIndex < 0)
              return JS_FALSE;
-         if (!(pn->pn_extra & PNX_POPVAR))
+         if (!(pn->pn_xflags & PNX_POPVAR))
              return js_Emit1(cx, cg, JSOP_NOP) >= 0;
      }
-     return !(pn->pn_extra & PNX_POPVAR) || js_Emit1(cx, cg, JSOP_POP) >= 0;
+     return !(pn->pn_xflags & PNX_POPVAR) || js_Emit1(cx, cg, JSOP_POP) >= 0;
  }
- #if defined DEBUG_brendanXXX || defined DEBUG_mrbkap
+ #if defined DEBUG_brendan || defined DEBUG_mrbkap
  static JSBool
  GettableNoteForNextOp(JSCodeGenerator *cg)
  {
-Line 3871
+Line 4228
      JSOp op;
      JSTokenType type;
      uint32 argc;
+ #if JS_HAS_SHARP_VARS
+     jsint sharpnum;
+ #endif
      JS_CHECK_RECURSION(cx, return JS_FALSE);
-Line 3879
+Line 4239
      pn->pn_offset = top = CG_OFFSET(cg);
      /* Emit notes to tell the current bytecode's source line number. */
-     UPDATE_LINE_NUMBER_NOTES(cx, cg, pn);
+     UPDATE_LINE_NUMBER_NOTES(cx, cg, pn->pn_pos.begin.lineno);
      switch (pn->pn_type) {
        case TOK_FUNCTION:
        {
          JSFunction *fun;
-         void *cg2mark;
-         JSCodeGenerator *cg2;
          uintN slot;
  #if JS_HAS_XML_SUPPORT
-Line 3897
+Line 4255
          }
  #endif
-         fun = (JSFunction *) pn->pn_funpob->object;
+         fun = (JSFunction *) pn->pn_funbox->object;
+         JS_ASSERT(FUN_INTERPRETED(fun));
          if (fun->u.i.script) {
              /*
               * This second pass is needed to emit JSOP_NOP with a source note
-Line 3905
+Line 4264
               * comments in the TOK_LC case.
               */
              JS_ASSERT(pn->pn_op == JSOP_NOP);
-             JS_ASSERT(cg->treeContext.flags & TCF_IN_FUNCTION);
+             JS_ASSERT(cg->flags & TCF_IN_FUNCTION);
-             JS_ASSERT(pn->pn_index != (uint32) -1);
              if (!EmitFunctionDefNop(cx, cg, pn->pn_index))
                  return JS_FALSE;
              break;
          }
-         /*
+         JS_ASSERT_IF(cx->options & JSOPTION_ANONFUNFIX,
-          * Limit static nesting depth to fit in 16 bits. See cg2->staticDepth
+                      pn->pn_defn ||
-          * assignment below.
+                      (!pn->pn_used && !pn->isTopLevel()) ||
-          */
+                      (fun->flags & JSFUN_LAMBDA));
-         if (cg->staticDepth == JS_BITMASK(16)) {
-             JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_TOO_DEEP,
+         JS_ASSERT_IF(pn->pn_funbox->tcflags & TCF_FUN_HEAVYWEIGHT,
-                                  js_function_str);
+                      FUN_KIND(fun) == JSFUN_INTERPRETED);
-             return JS_FALSE;
-         }
          /* Generate code for the function's body. */
-         cg2mark = JS_ARENA_MARK(cg->codePool);
+         void *cg2mark = JS_ARENA_MARK(cg->codePool);
-         JS_ARENA_ALLOCATE_TYPE(cg2, JSCodeGenerator, cg->codePool);
+         void *cg2space;
-         if (!cg2) {
+         JS_ARENA_ALLOCATE_TYPE(cg2space, JSCodeGenerator, cg->codePool);
+         if (!cg2space) {
              js_ReportOutOfScriptQuota(cx);
              return JS_FALSE;
          }
-         js_InitCodeGenerator(cx, cg2, cg->treeContext.parseContext,
+         JSCodeGenerator *cg2 =
-                              cg->codePool, cg->notePool,
+             new (cg2space) JSCodeGenerator(cg->compiler,
-                              pn->pn_pos.begin.lineno);
+                                            cg->codePool, cg->notePool,
-         cg2->treeContext.flags = (uint16) (pn->pn_flags | TCF_IN_FUNCTION);
+                                            pn->pn_pos.begin.lineno);
-         cg2->treeContext.u.fun = fun;
+         cg2->flags = (uint16) (pn->pn_funbox->tcflags | TCF_IN_FUNCTION);
-         cg2->staticDepth = cg->staticDepth + 1;
+         cg2->fun = fun;
+         cg2->funbox = pn->pn_funbox;
          cg2->parent = cg;
-         /* We metered the max scope depth when parsed the function. */
+         /*
-         JS_SCOPE_DEPTH_METERING(cg2->treeContext.maxScopeDepth = (uintN) -1);
+          * jsparse.cpp:SetStaticLevel limited static nesting depth to fit in 16
-         if (!js_EmitFunctionScript(cx, cg2, pn->pn_body)) {
+          * bits and to reserve the all-ones value, thereby reserving the magic
+          * FREE_UPVAR_COOKIE value. Note the cg2->staticLevel assignment below.
+          */
+         JS_ASSERT(cg->staticLevel < JS_BITMASK(16) - 1);
+         cg2->staticLevel = cg->staticLevel + 1;
+         /* We measured the max scope depth when we parsed the function. */
+         JS_SCOPE_DEPTH_METERING(cg2->maxScopeDepth = (uintN) -1);
+         if (!js_EmitFunctionScript(cx, cg2, pn->pn_body))
              pn = NULL;
-         } else {
-             /*
-              * We need an activation object if an inner peeks out, or if such
-              * inner-peeking caused one of our inners to become heavyweight.
-              */
-             if (cg2->treeContext.flags &
-                 (TCF_FUN_USES_NONLOCALS | TCF_FUN_HEAVYWEIGHT)) {
-                 cg->treeContext.flags |= TCF_FUN_HEAVYWEIGHT;
-             }
-         }
-         js_FinishCodeGenerator(cx, cg2);
+         cg2->~JSCodeGenerator();
          JS_ARENA_RELEASE(cg->codePool, cg2mark);
          cg2 = NULL;
          if (!pn)
              return JS_FALSE;
          /* Make the function object a literal in the outer script's pool. */
-         index = IndexParsedObject(pn->pn_funpob, &cg->objectList);
+         index = cg->objectList.index(pn->pn_funbox);
          /* Emit a bytecode pointing to the closure object in its immediate. */
-         if (pn->pn_op != JSOP_NOP) {
+         op = PN_OP(pn);
-             if ((pn->pn_flags & TCF_GENEXP_LAMBDA) &&
+         if (op != JSOP_NOP) {
+             if ((pn->pn_funbox->tcflags & TCF_GENEXP_LAMBDA) &&
                  js_NewSrcNote(cx, cg, SRC_GENEXP) < 0) {
                  return JS_FALSE;
              }
-             EMIT_INDEX_OP(PN_OP(pn), index);
+             EMIT_INDEX_OP(op, index);
              break;
          }
-Line 3980
+Line 4337
           * invocation of the emitter and calls to js_EmitTree for function
           * definitions can be scheduled before generating the rest of code.
           */
-         if (!(cg->treeContext.flags & TCF_IN_FUNCTION)) {
+         if (!(cg->flags & TCF_IN_FUNCTION)) {
-             JS_ASSERT(!cg->treeContext.topStmt);
+             JS_ASSERT(!cg->topStmt);
              CG_SWITCH_TO_PROLOG(cg);
-             EMIT_INDEX_OP(JSOP_DEFFUN, index);
+             op = FUN_FLAT_CLOSURE(fun) ? JSOP_DEFFUN_FC : JSOP_DEFFUN;
+             EMIT_INDEX_OP(op, index);
              CG_SWITCH_TO_MAIN(cg);
              /* Emit NOP for the decompiler. */
-Line 3993
+Line 4351
  #ifdef DEBUG
              JSLocalKind localKind =
  #endif
-                 js_LookupLocal(cx, cg->treeContext.u.fun, fun->atom, &slot);
+                 js_LookupLocal(cx, cg->fun, fun->atom, &slot);
              JS_ASSERT(localKind == JSLOCAL_VAR || localKind == JSLOCAL_CONST);
-             JS_ASSERT(pn->pn_index == (uint32) -1);
+             JS_ASSERT(index < JS_BIT(20));
              pn->pn_index = index;
-             if (!EmitSlotIndexOp(cx, JSOP_DEFLOCALFUN, slot, index, cg))
+             op = FUN_FLAT_CLOSURE(fun) ? JSOP_DEFLOCALFUN_FC : JSOP_DEFLOCALFUN;
+             if (!EmitSlotIndexOp(cx, op, slot, index, cg))
                  return JS_FALSE;
          }
          break;
        }
+       case TOK_ARGSBODY:
+         ok = js_EmitTree(cx, cg, pn->last());
+         break;
+       case TOK_UPVARS:
+         JS_ASSERT(cg->lexdeps.count == 0);
+         JS_ASSERT(pn->pn_names.count != 0);
+         cg->lexdeps = pn->pn_names;
+         ok = js_EmitTree(cx, cg, pn->pn_tree);
+         break;
        case TOK_IF:
          /* Initialize so we can detect else-if chains and avoid recursion. */
-Line 4016
+Line 4385
              return JS_FALSE;
          top = CG_OFFSET(cg);
          if (stmtInfo.type == STMT_IF) {
-             js_PushStatement(&cg->treeContext, &stmtInfo, STMT_IF, top);
+             js_PushStatement(cg, &stmtInfo, STMT_IF, top);
          } else {
              /*
               * We came here from the goto further below that detects else-if
-Line 4114
+Line 4483
           * that bracketed the body. But given the SRC_WHILE note, it is easy
           * to support the more efficient scheme.
           */
-         js_PushStatement(&cg->treeContext, &stmtInfo, STMT_WHILE_LOOP, top);
+         js_PushStatement(cg, &stmtInfo, STMT_WHILE_LOOP, top);
          noteIndex = js_NewSrcNote(cx, cg, SRC_WHILE);
          if (noteIndex < 0)
              return JS_FALSE;
-Line 4122
+Line 4491
          if (jmp < 0)
              return JS_FALSE;
          top = CG_OFFSET(cg);
+         if (!js_Emit1(cx, cg, JSOP_LOOP))
+             return JS_FALSE;
          if (!js_EmitTree(cx, cg, pn->pn_right))
              return JS_FALSE;
          CHECK_AND_SET_JUMP_OFFSET_AT(cx, cg, jmp);
-Line 4143
+Line 4514
          /* Compile the loop body. */
          top = CG_OFFSET(cg);
-         js_PushStatement(&cg->treeContext, &stmtInfo, STMT_DO_LOOP, top);
+         if (!js_Emit1(cx, cg, JSOP_LOOP))
+             return JS_FALSE;
+         js_PushStatement(cg, &stmtInfo, STMT_DO_LOOP, top);
          if (!js_EmitTree(cx, cg, pn->pn_left))
              return JS_FALSE;
-Line 4174
+Line 4547
          beq = 0;                /* suppress gcc warnings */
          jmp = -1;
          pn2 = pn->pn_left;
-         js_PushStatement(&cg->treeContext, &stmtInfo, STMT_FOR_LOOP, top);
+         js_PushStatement(cg, &stmtInfo, STMT_FOR_LOOP, top);
          if (pn2->pn_type == TOK_IN) {
              /* Set stmtInfo type for later testing. */
-Line 4188
+Line 4561
               * result off the stack.
               *
               * All the logic to do this is implemented in the outer switch's
-              * TOK_VAR case, conditioned on pn_extra flags set by the parser.
+              * TOK_VAR case, conditioned on pn_xflags flags set by the parser.
               *
               * In the 'for (var x = i in o) ...' case, the js_EmitTree(...pn3)
               * called here will generate the proper note for the assignment
-Line 4207
+Line 4580
               */
              pn3 = pn2->pn_left;
              type = PN_TYPE(pn3);
-             cg->treeContext.flags |= TCF_IN_FOR_INIT;
+             cg->flags |= TCF_IN_FOR_INIT;
              if (TOKEN_TYPE_IS_DECL(type) && !js_EmitTree(cx, cg, pn3))
                  return JS_FALSE;
-             cg->treeContext.flags &= ~TCF_IN_FOR_INIT;
+             cg->flags &= ~TCF_IN_FOR_INIT;
              /* Compile the object expression to the right of 'in'. */
              if (!js_EmitTree(cx, cg, pn2->pn_right))
-Line 4240
+Line 4613
              top = CG_OFFSET(cg);
              SET_STATEMENT_TOP(&stmtInfo, top);
+             if (!js_Emit1(cx, cg, JSOP_LOOP))
+                 return JS_FALSE;
  #ifdef DEBUG
              intN loopDepth = cg->stackDepth;
-Line 4290
+Line 4665
  #if JS_HAS_BLOCK_SCOPE
                       type == TOK_LET ||
  #endif
-                      (type == TOK_VAR && !pn3->pn_expr)) &&
+                      (type == TOK_VAR && !pn3->maybeExpr())) &&
                      js_NewSrcNote2(cx, cg, SRC_DECL,
                                     (type == TOK_VAR)
                                     ? SRC_DECL_VAR
                                     : SRC_DECL_LET) < 0) {
                      return JS_FALSE;
                  }
-                 if (pn3->pn_slot >= 0) {
+                 if (pn3->pn_cookie != FREE_UPVAR_COOKIE) {
                      op = PN_OP(pn3);
                      switch (op) {
                        case JSOP_GETARG:   /* FALL THROUGH */
-Line 4314
+Line 4689
                          return JS_FALSE;
                      op = PN_OP(pn3);
                  }
-                 if (pn3->pn_slot >= 0) {
+                 if (pn3->isConst()) {
-                     if (pn3->pn_const) {
+                     js_ReportCompileErrorNumber(cx, CG_TS(cg), pn3, JSREPORT_ERROR,
-                         JS_ASSERT(op == JSOP_FORLOCAL);
+                                                 JSMSG_BAD_FOR_LEFTSIDE);
-                         js_ReportCompileErrorNumber(cx, CG_TS(cg), pn3, JSREPORT_ERROR,
+                     return JS_FALSE;
-                                                     JSMSG_BAD_FOR_LEFTSIDE);
+                 }
-                         return JS_FALSE;
+                 if (pn3->pn_cookie != FREE_UPVAR_COOKIE) {
-                     }
+                     atomIndex = (jsatomid) pn3->pn_cookie;
-                     atomIndex = (jsatomid) pn3->pn_slot;
                      EMIT_UINT16_IMM_OP(op, atomIndex);
                  } else {
                      if (!EmitAtomOp(cx, pn3, op, cg))
-Line 4335
+Line 4709
                   * has no side effects.
                   */
                  useful = JS_FALSE;
-                 if (!CheckSideEffects(cx, cg, pn3->pn_expr, &useful))
+                 if (!CheckSideEffects(cx, cg, pn3->expr(), &useful))
                      return JS_FALSE;
                  if (!useful) {
                      if (!EmitPropOp(cx, pn3, JSOP_FORPROP, cg, JS_FALSE))
-Line 4421
+Line 4795
                  /* No initializer: emit an annotated nop for the decompiler. */
                  op = JSOP_NOP;
              } else {
-                 cg->treeContext.flags |= TCF_IN_FOR_INIT;
+                 cg->flags |= TCF_IN_FOR_INIT;
  #if JS_HAS_DESTRUCTURING
                  if (pn3->pn_type == TOK_ASSIGN &&
                      !MaybeEmitGroupAssignment(cx, cg, op, pn3, &op)) {
-Line 4439
+Line 4813
                           * just for the decompiler.
                           */
                          JS_ASSERT(pn3->pn_arity == PN_LIST);
-                         if (pn3->pn_extra & PNX_GROUPINIT)
+                         if (pn3->pn_xflags & PNX_GROUPINIT)
                              op = JSOP_NOP;
                      }
                  }
-                 cg->treeContext.flags &= ~TCF_IN_FOR_INIT;
+                 cg->flags &= ~TCF_IN_FOR_INIT;
              }
              /*
-Line 4468
+Line 4842
              SET_STATEMENT_TOP(&stmtInfo, top);
              /* Emit code for the loop body. */
+             if (!js_Emit1(cx, cg, JSOP_LOOP))
+                 return JS_FALSE;
              if (!js_EmitTree(cx, cg, pn->pn_right))
                  return JS_FALSE;
-Line 4563
+Line 4939
          break;
        case TOK_BREAK:
-         stmt = cg->treeContext.topStmt;
+         stmt = cg->topStmt;
          atom = pn->pn_atom;
          if (atom) {
-             ale = js_IndexAtom(cx, atom, &cg->atomList);
+             ale = cg->atomList.add(cg->compiler, atom);
              if (!ale)
                  return JS_FALSE;
-             while (stmt->type != STMT_LABEL || stmt->u.label != atom)
+             while (stmt->type != STMT_LABEL || stmt->label != atom)
                  stmt = stmt->down;
              noteType = SRC_BREAK2LABEL;
          } else {
-Line 4584
+Line 4960
          break;
        case TOK_CONTINUE:
-         stmt = cg->treeContext.topStmt;
+         stmt = cg->topStmt;
          atom = pn->pn_atom;
          if (atom) {
              /* Find the loop statement enclosed by the matching label. */
              JSStmtInfo *loop = NULL;
-             ale = js_IndexAtom(cx, atom, &cg->atomList);
+             ale = cg->atomList.add(cg->compiler, atom);
              if (!ale)
                  return JS_FALSE;
-             while (stmt->type != STMT_LABEL || stmt->u.label != atom) {
+             while (stmt->type != STMT_LABEL || stmt->label != atom) {
                  if (STMT_IS_LOOP(stmt))
                      loop = stmt;
                  stmt = stmt->down;
-Line 4613
+Line 4989
        case TOK_WITH:
          if (!js_EmitTree(cx, cg, pn->pn_left))
              return JS_FALSE;
-         js_PushStatement(&cg->treeContext, &stmtInfo, STMT_WITH, CG_OFFSET(cg));
+         js_PushStatement(cg, &stmtInfo, STMT_WITH, CG_OFFSET(cg));
          if (js_Emit1(cx, cg, JSOP_ENTERWITH) < 0)
              return JS_FALSE;
          if (!js_EmitTree(cx, cg, pn->pn_right))
-Line 4635
+Line 5011
           * Push stmtInfo to track jumps-over-catches and gosubs-to-finally
           * for later fixup.
           *
-          * When a finally block is 'active' (STMT_FINALLY on the treeContext),
+          * When a finally block is active (STMT_FINALLY in our tree context),
           * non-local jumps (including jumps-over-catches) result in a GOSUB
           * being written into the bytecode stream and fixed-up later (c.f.
           * EmitBackPatchOp and BackPatch).
           */
-         js_PushStatement(&cg->treeContext, &stmtInfo,
+         js_PushStatement(cg, &stmtInfo,
                           pn->pn_kid3 ? STMT_FINALLY : STMT_TRY,
                           CG_OFFSET(cg));
-Line 4759
+Line 5135
                   * guardJump at the next catch (the guard mismatch case).
                   */
                  JS_ASSERT(pn3->pn_type == TOK_LEXICALSCOPE);
-                 count = OBJ_BLOCK_COUNT(cx, pn3->pn_pob->object);
+                 count = OBJ_BLOCK_COUNT(cx, pn3->pn_objbox->object);
                  if (!js_EmitTree(cx, cg, pn3))
                      return JS_FALSE;
-Line 4786
+Line 5162
                   * Save a pointer to the last catch node to handle try-finally
                   * and try-catch(guard)-finally special cases.
                   */
-                 lastCatch = pn3->pn_expr;
+                 lastCatch = pn3->expr();
              }
          }
-Line 4829
+Line 5205
              /* Indicate that we're emitting a subroutine body. */
              stmtInfo.type = STMT_SUBROUTINE;
-             if (!UpdateLineNumberNotes(cx, cg, pn->pn_kid3))
+             if (!UpdateLineNumberNotes(cx, cg, pn->pn_kid3->pn_pos.begin.lineno))
                  return JS_FALSE;
              if (js_Emit1(cx, cg, JSOP_FINALLY) < 0 ||
                  !js_EmitTree(cx, cg, pn->pn_kid3) ||
-Line 4880
+Line 5256
           * Morph STMT_BLOCK to STMT_CATCH, note the block entry code offset,
           * and save the block object atom.
           */
-         stmt = cg->treeContext.topStmt;
+         stmt = cg->topStmt;
          JS_ASSERT(stmt->type == STMT_BLOCK && (stmt->flags & SIF_SCOPE));
          stmt->type = STMT_CATCH;
          catchStart = stmt->update;
-         blockObj = stmt->u.blockObj;
+         blockObj = stmt->blockObj;
          /* Go up one statement info record to the TRY or FINALLY record. */
          stmt = stmt->down;
-Line 4914
+Line 5290
  #endif
            case TOK_NAME:
-             /* Inline BindNameToSlot for pn2. */
+             /* Inline and specialize BindNameToSlot for pn2. */
-             JS_ASSERT(pn2->pn_slot == -1);
+             JS_ASSERT(pn2->pn_cookie != FREE_UPVAR_COOKIE);
-             pn2->pn_slot = AdjustBlockSlot(cx, cg,
+             EMIT_UINT16_IMM_OP(JSOP_SETLOCALPOP, pn2->pn_cookie);
-                                            OBJ_BLOCK_DEPTH(cx, blockObj));
-             if (pn2->pn_slot < 0)
-                 return JS_FALSE;
-             EMIT_UINT16_IMM_OP(JSOP_SETLOCALPOP, pn2->pn_slot);
              break;
            default:
-Line 5001
+Line 5373
  #if JS_HAS_GENERATORS
        case TOK_YIELD:
-         if (!(cg->treeContext.flags & TCF_IN_FUNCTION)) {
+         if (!(cg->flags & TCF_IN_FUNCTION)) {
              js_ReportCompileErrorNumber(cx, CG_TS(cg), pn, JSREPORT_ERROR,
                                          JSMSG_BAD_RETURN_OR_YIELD,
                                          js_yield_str);
-Line 5022
+Line 5394
  #endif
        case TOK_LC:
+       {
  #if JS_HAS_XML_SUPPORT
          if (pn->pn_arity == PN_UNARY) {
              if (!js_EmitTree(cx, cg, pn->pn_kid))
-Line 5036
+Line 5409
          noteIndex = -1;
          tmp = CG_OFFSET(cg);
-         if (pn->pn_extra & PNX_NEEDBRACES) {
+         if (pn->pn_xflags & PNX_NEEDBRACES) {
              noteIndex = js_NewSrcNote2(cx, cg, SRC_BRACE, 0);
              if (noteIndex < 0 || js_Emit1(cx, cg, JSOP_NOP) < 0)
                  return JS_FALSE;
          }
-         js_PushStatement(&cg->treeContext, &stmtInfo, STMT_BLOCK, top);
+         js_PushStatement(cg, &stmtInfo, STMT_BLOCK, top);
-         if (pn->pn_extra & PNX_FUNCDEFS) {
+         JSParseNode *pnchild = pn->pn_head;
+         if (pn->pn_xflags & PNX_FUNCDEFS) {
              /*
               * This block contains top-level function definitions. To ensure
-              * that we emit the bytecode defining them prior the rest of code
+              * that we emit the bytecode defining them before the rest of code
               * in the block we use a separate pass over functions. During the
               * main pass later the emitter will add JSOP_NOP with source notes
               * for the function to preserve the original functions position
-Line 5055
+Line 5430
               * Currently this is used only for functions, as compile-as-we go
               * mode for scripts does not allow separate emitter passes.
               */
-             JS_ASSERT(cg->treeContext.flags & TCF_IN_FUNCTION);
+             JS_ASSERT(cg->flags & TCF_IN_FUNCTION);
-             for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
+             if (pn->pn_xflags & PNX_DESTRUCT) {
+                 /*
+                  * Assign the destructuring arguments before defining any
+                  * functions, see bug 419662.
+                  */
+                 JS_ASSERT(pnchild->pn_type == TOK_SEMI);
+                 JS_ASSERT(pnchild->pn_kid->pn_type == TOK_COMMA);
+                 if (!js_EmitTree(cx, cg, pnchild))
+                     return JS_FALSE;
+                 pnchild = pnchild->pn_next;
+             }
+             for (pn2 = pnchild; pn2; pn2 = pn2->pn_next) {
                  if (pn2->pn_type == TOK_FUNCTION) {
                      if (pn2->pn_op == JSOP_NOP) {
                          if (!js_EmitTree(cx, cg, pn2))
-Line 5073
+Line 5460
                  }
              }
          }
-         for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
+         for (pn2 = pnchild; pn2; pn2 = pn2->pn_next) {
              if (!js_EmitTree(cx, cg, pn2))
                  return JS_FALSE;
          }
-Line 5086
+Line 5473
          ok = js_PopStatementCG(cx, cg);
          break;
+       }
        case TOK_SEQ:
          JS_ASSERT(pn->pn_arity == PN_LIST);
-         js_PushStatement(&cg->treeContext, &stmtInfo, STMT_SEQ, top);
+         js_PushStatement(cg, &stmtInfo, STMT_SEQ, top);
          for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
              if (!js_EmitTree(cx, cg, pn2))
                  return JS_FALSE;
-Line 5109
+Line 5497
               * API users may also set the JSOPTION_NO_SCRIPT_RVAL option when
               * calling JS_Compile* to suppress JSOP_POPV.
               */
-             useful = wantval =
+             useful = wantval = !(cg->flags & (TCF_IN_FUNCTION | TCF_NO_SCRIPT_RVAL));
-                 !(cg->treeContext.flags & (TCF_IN_FUNCTION | TCF_NO_SCRIPT_RVAL));
              if (!useful) {
                  if (!CheckSideEffects(cx, cg, pn2, &useful))
                      return JS_FALSE;
-Line 5123
+Line 5510
               * labeled compound statement.
               */
              if (!useful &&
-                 (!cg->treeContext.topStmt ||
+                 (!cg->topStmt ||
-                  cg->treeContext.topStmt->type != STMT_LABEL ||
+                  cg->topStmt->type != STMT_LABEL ||
-                  cg->treeContext.topStmt->update < CG_OFFSET(cg))) {
+                  cg->topStmt->update < CG_OFFSET(cg))) {
                  CG_CURRENT_LINE(cg) = pn2->pn_pos.begin.lineno;
                  if (!js_ReportCompileErrorNumber(cx, CG_TS(cg), pn2,
                                                   JSREPORT_WARNING |
-Line 5155
+Line 5542
        case TOK_COLON:
          /* Emit an annotated nop so we know to decompile a label. */
          atom = pn->pn_atom;
-         ale = js_IndexAtom(cx, atom, &cg->atomList);
+         ale = cg->atomList.add(cg->compiler, atom);
          if (!ale)
              return JS_FALSE;
-         pn2 = pn->pn_expr;
+         pn2 = pn->expr();
          noteType = (pn2->pn_type == TOK_LC ||
                      (pn2->pn_type == TOK_LEXICALSCOPE &&
-                      pn2->pn_expr->pn_type == TOK_LC))
+                      pn2->expr()->pn_type == TOK_LC))
                     ? SRC_LABELBRACE
                     : SRC_LABEL;
          noteIndex = js_NewSrcNote2(cx, cg, noteType,
-Line 5172
+Line 5559
          }
          /* Emit code for the labeled statement. */
-         js_PushStatement(&cg->treeContext, &stmtInfo, STMT_LABEL,
+         js_PushStatement(cg, &stmtInfo, STMT_LABEL, CG_OFFSET(cg));
-                          CG_OFFSET(cg));
+         stmtInfo.label = atom;
-         stmtInfo.u.label = atom;
          if (!js_EmitTree(cx, cg, pn2))
              return JS_FALSE;
          if (!js_PopStatementCG(cx, cg))
-Line 5228
+Line 5614
            case TOK_NAME:
              if (!BindNameToSlot(cx, cg, pn2))
                  return JS_FALSE;
-             if (pn2->pn_slot >= 0) {
+             if (pn2->pn_cookie != FREE_UPVAR_COOKIE) {
-                 atomIndex = (jsatomid) pn2->pn_slot;
+                 atomIndex = (jsatomid) pn2->pn_cookie;
              } else {
-                 ale = js_IndexAtom(cx, pn2->pn_atom, &cg->atomList);
+                 ale = cg->atomList.add(cg->compiler, pn2->pn_atom);
                  if (!ale)
                      return JS_FALSE;
                  atomIndex = ALE_INDEX(ale);
-                 EMIT_INDEX_OP(JSOP_BINDNAME, atomIndex);
+                 if (!pn2->isConst())
+                     EMIT_INDEX_OP(JSOP_BINDNAME, atomIndex);
              }
              break;
            case TOK_DOT:
-             if (!js_EmitTree(cx, cg, pn2->pn_expr))
+             if (!js_EmitTree(cx, cg, pn2->expr()))
                  return JS_FALSE;
-             ale = js_IndexAtom(cx, pn2->pn_atom, &cg->atomList);
+             ale = cg->atomList.add(cg->compiler, pn2->pn_atom);
              if (!ale)
                  return JS_FALSE;
              atomIndex = ALE_INDEX(ale);
-Line 5286
+Line 5673
                   * supported.
                   */
                  js_ReportCompileErrorNumber(cx,
-                                             TS(cg->treeContext.parseContext),
+                                             TS(cg->compiler),
                                              pn2, JSREPORT_ERROR,
                                              JSMSG_BAD_GETTER_OR_SETTER,
                                              (op == JSOP_GETTER)
-Line 5302
+Line 5689
          if (op != JSOP_NOP) {
              switch (pn2->pn_type) {
                case TOK_NAME:
-                 if (pn2->pn_op != JSOP_SETNAME) {
+                 if (pn2->isConst()) {
-                     EMIT_UINT16_IMM_OP((pn2->pn_op == JSOP_SETGVAR)
+                     if (PN_OP(pn2) == JSOP_CALLEE) {
+                         if (js_Emit1(cx, cg, JSOP_CALLEE) < 0)
+                             return JS_FALSE;
+                     } else {
+                         EMIT_INDEX_OP(PN_OP(pn2), atomIndex);
+                     }
+                 } else if (PN_OP(pn2) == JSOP_SETNAME) {
+                     if (js_Emit1(cx, cg, JSOP_DUP) < 0)
+                         return JS_FALSE;
+                     EMIT_INDEX_OP(JSOP_GETXPROP, atomIndex);
+                 } else {
+                     EMIT_UINT16_IMM_OP((PN_OP(pn2) == JSOP_SETGVAR)
                                         ? JSOP_GETGVAR
-                                        : (pn2->pn_op == JSOP_SETARG)
+                                        : (PN_OP(pn2) == JSOP_GETUPVAR)
+                                        ? JSOP_GETUPVAR
+                                        : (PN_OP(pn2) == JSOP_SETARG)
                                         ? JSOP_GETARG
                                         : JSOP_GETLOCAL,
                                         atomIndex);
-                     break;
                  }
-                 if (js_Emit1(cx, cg, JSOP_DUP) < 0)
-                     return JS_FALSE;
-                 EMIT_INDEX_OP(JSOP_GETXPROP, atomIndex);
                  break;
                case TOK_DOT:
                  if (js_Emit1(cx, cg, JSOP_DUP) < 0)
-Line 5321
+Line 5717
                  if (pn2->pn_atom == cx->runtime->atomState.lengthAtom) {
                      if (js_Emit1(cx, cg, JSOP_LENGTH) < 0)
                          return JS_FALSE;
+                 } else if (pn2->pn_atom == cx->runtime->atomState.protoAtom) {
+                     if (!EmitIndexOp(cx, JSOP_QNAMEPART, atomIndex, cg))
+                         return JS_FALSE;
+                     if (js_Emit1(cx, cg, JSOP_GETELEM) < 0)
+                         return JS_FALSE;
                  } else {
                      EMIT_INDEX_OP(JSOP_GETPROP, atomIndex);
                  }
-Line 5348
+Line 5749
          /* If += etc., emit the binary operator with a decompiler note. */
          if (op != JSOP_NOP) {
              /*
-              * Take care to avoid SRC_ASSIGNOP if the left-hand side is a
+              * Take care to avoid SRC_ASSIGNOP if the left-hand side is a const
-              * const declared in a function (i.e., with non-negative pn_slot
+              * declared in the current compilation unit, as in this case (just
-              * and when pn_const is true), as in this case (just a bit further
+              * a bit further below) we will avoid emitting the assignment op.
-              * below) we will avoid emitting the assignment op.
+              */
-              */
+             if (pn2->pn_type != TOK_NAME || !pn2->isConst()) {
-             if (pn2->pn_type != TOK_NAME ||
-                 pn2->pn_slot < 0 ||
-                 !pn2->pn_const) {
                  if (js_NewSrcNote(cx, cg, SRC_ASSIGNOP) < 0)
                      return JS_FALSE;
              }
-Line 5376
+Line 5774
          /* Finally, emit the specialized assignment bytecode. */
          switch (pn2->pn_type) {
            case TOK_NAME:
-             if (pn2->pn_slot >= 0) {
+             if (pn2->isConst())
-                 if (!pn2->pn_const)
-                     EMIT_UINT16_IMM_OP(PN_OP(pn2), atomIndex);
                  break;
-             }
              /* FALL THROUGH */
            case TOK_DOT:
              EMIT_INDEX_OP(PN_OP(pn2), atomIndex);
-Line 5542
+Line 5937
        case TOK_DBLCOLON:
              if (pn->pn_arity == PN_NAME) {
-                 if (!js_EmitTree(cx, cg, pn->pn_expr))
+                 if (!js_EmitTree(cx, cg, pn->expr()))
                      return JS_FALSE;
                  if (!EmitAtomOp(cx, pn, PN_OP(pn), cg))
                      return JS_FALSE;
-Line 5554
+Line 5949
               * possibly including a let (a = b) ... expression.  We must clear
               * TCF_IN_FOR_INIT to avoid mis-compiling such beasts.
               */
-             oldflags = cg->treeContext.flags;
+             oldflags = cg->flags;
-             cg->treeContext.flags &= ~TCF_IN_FOR_INIT;
+             cg->flags &= ~TCF_IN_FOR_INIT;
  #endif
              /* Binary operators that evaluate both operands unconditionally. */
-Line 5564
+Line 5959
              if (!js_EmitTree(cx, cg, pn->pn_right))
                  return JS_FALSE;
  #if JS_HAS_XML_SUPPORT
-             cg->treeContext.flags |= oldflags & TCF_IN_FOR_INIT;
+             cg->flags |= oldflags & TCF_IN_FOR_INIT;
  #endif
              if (js_Emit1(cx, cg, PN_OP(pn)) < 0)
                  return JS_FALSE;
-Line 5598
+Line 5993
              if (pn3->pn_type != TOK_NAME)
                  op = JSOP_TYPEOFEXPR;
          }
-         oldflags = cg->treeContext.flags;
+         oldflags = cg->flags;
-         cg->treeContext.flags &= ~TCF_IN_FOR_INIT;
+         cg->flags &= ~TCF_IN_FOR_INIT;
          if (!js_EmitTree(cx, cg, pn2))
              return JS_FALSE;
-         cg->treeContext.flags |= oldflags & TCF_IN_FOR_INIT;
+         cg->flags |= oldflags & TCF_IN_FOR_INIT;
          if (js_Emit1(cx, cg, op) < 0)
              return JS_FALSE;
          break;
-Line 5621
+Line 6016
              if (!BindNameToSlot(cx, cg, pn2))
                  return JS_FALSE;
              op = PN_OP(pn2);
-             if (pn2->pn_slot >= 0) {
+             if (op == JSOP_CALLEE) {
-                 if (pn2->pn_const) {
+                 if (js_Emit1(cx, cg, op) < 0)
-                     /* Incrementing a declared const: just get its value. */
+                     return JS_FALSE;
-                     op = (JOF_OPTYPE(op) == JOF_ATOM)
+             } else if (pn2->pn_cookie != FREE_UPVAR_COOKIE) {
-                          ? JSOP_GETGVAR
+                 atomIndex = (jsatomid) pn2->pn_cookie;
-                          : JSOP_GETLOCAL;
-                 }
-                 atomIndex = (jsatomid) pn2->pn_slot;
                  EMIT_UINT16_IMM_OP(op, atomIndex);
              } else {
+                 JS_ASSERT(JOF_OPTYPE(op) == JOF_ATOM);
                  if (!EmitAtomOp(cx, pn2, op, cg))
                      return JS_FALSE;
+                 break;
+             }
+             if (pn2->isConst()) {
+                 if (js_Emit1(cx, cg, JSOP_POS) < 0)
+                     return JS_FALSE;
+                 op = PN_OP(pn);
+                 if (!(js_CodeSpec[op].format & JOF_POST)) {
+                     if (js_Emit1(cx, cg, JSOP_ONE) < 0)
+                         return JS_FALSE;
+                     op = (js_CodeSpec[op].format & JOF_INC) ? JSOP_ADD : JSOP_SUB;
+                     if (js_Emit1(cx, cg, op) < 0)
+                         return JS_FALSE;
+                 }
              }
              break;
            case TOK_DOT:
-Line 5677
+Line 6083
          pn2 = pn->pn_kid;
          switch (pn2->pn_type) {
            case TOK_NAME:
-             pn2->pn_op = JSOP_DELNAME;
              if (!BindNameToSlot(cx, cg, pn2))
                  return JS_FALSE;
              op = PN_OP(pn2);
-Line 5750
+Line 6155
          if (jmp < 0)
              return JS_FALSE;
          top = CG_OFFSET(cg);
+         if (!js_Emit1(cx, cg, JSOP_LOOP))
+             return JS_FALSE;
          if (!js_EmitTree(cx, cg, pn->pn_right))
              return JS_FALSE;
          CHECK_AND_SET_JUMP_OFFSET_AT(cx, cg, jmp);
-Line 5817
+Line 6224
            default:
              /*
               * Push null as a placeholder for the global object, per ECMA-262
-              * 11.2.3 step 6. We use JSOP_NULLTHIS to distinguish this opcode
+              * 11.2.3 step 6.
-              * from JSOP_NULL (see jstracer.cpp for one use-case).
               */
              if (!js_EmitTree(cx, cg, pn2))
                  return JS_FALSE;
-             if (js_Emit1(cx, cg, JSOP_NULLTHIS) < 0)
+             if (js_Emit1(cx, cg, JSOP_NULL) < 0)
                  return JS_FALSE;
          }
-Line 5834
+Line 6240
           * JSOP_NEW bytecode with a two-byte immediate telling how many args
           * were pushed on the operand stack.
           */
-         oldflags = cg->treeContext.flags;
+         oldflags = cg->flags;
-         cg->treeContext.flags &= ~TCF_IN_FOR_INIT;
+         cg->flags &= ~TCF_IN_FOR_INIT;
          for (pn3 = pn2->pn_next; pn3; pn3 = pn3->pn_next) {
              if (!js_EmitTree(cx, cg, pn3))
                  return JS_FALSE;
          }
-         cg->treeContext.flags |= oldflags & TCF_IN_FOR_INIT;
+         cg->flags |= oldflags & TCF_IN_FOR_INIT;
          if (js_NewSrcNote2(cx, cg, SRC_PCBASE, CG_OFFSET(cg) - off) < 0)
              return JS_FALSE;
-Line 5854
+Line 6260
        case TOK_LEXICALSCOPE:
        {
-         JSParsedObjectBox *pob;
+         JSObjectBox *objbox;
          uintN count;
-         pob = pn->pn_pob;
+         objbox = pn->pn_objbox;
-         js_PushBlockScope(&cg->treeContext, &stmtInfo, pob->object,
+         js_PushBlockScope(cg, &stmtInfo, objbox->object, CG_OFFSET(cg));
-                           CG_OFFSET(cg));
          /*
           * If this lexical scope is not for a catch block, let block or let
-Line 5870
+Line 6275
           * statements get braces by default from the decompiler.
           */
          noteIndex = -1;
-         type = PN_TYPE(pn->pn_expr);
+         type = PN_TYPE(pn->expr());
          if (type != TOK_CATCH && type != TOK_LET && type != TOK_FOR &&
              (!(stmt = stmtInfo.down)
-              ? !(cg->treeContext.flags & TCF_IN_FUNCTION)
+              ? !(cg->flags & TCF_IN_FUNCTION)
               : stmt->type == STMT_BLOCK)) {
- #if defined DEBUG_brendanXXX || defined DEBUG_mrbkap
+ #if defined DEBUG_brendan || defined DEBUG_mrbkap
              /* There must be no source note already output for the next op. */
              JS_ASSERT(CG_NOTE_COUNT(cg) == 0 ||
                        CG_LAST_NOTE_OFFSET(cg) != CG_OFFSET(cg) ||
-Line 5887
+Line 6292
          }
          JS_ASSERT(CG_OFFSET(cg) == top);
-         if (!EmitObjectOp(cx, pob, JSOP_ENTERBLOCK, cg))
+         if (!EmitEnterBlock(cx, pn, cg))
              return JS_FALSE;
          if (!js_EmitTree(cx, cg, pn->pn_expr))
-Line 5906
+Line 6311
          }
          /* Emit the JSOP_LEAVEBLOCK or JSOP_LEAVEBLOCKEXPR opcode. */
-         count = OBJ_BLOCK_COUNT(cx, pob->object);
+         count = OBJ_BLOCK_COUNT(cx, objbox->object);
          EMIT_UINT16_IMM_OP(op, count);
          ok = js_PopStatementCG(cx, cg);
-Line 5952
+Line 6357
           */
          if (!js_EmitTree(cx, cg, pn->pn_kid))
              return JS_FALSE;
-         slot = cg->arrayCompDepth;
+         slot = AdjustBlockSlot(cx, cg, cg->arrayCompDepth);
-         slot = AdjustBlockSlot(cx, cg, slot);
          if (slot < 0)
              return JS_FALSE;
          EMIT_UINT16_IMM_OP(PN_OP(pn), slot);
-Line 5966
+Line 6370
        case TOK_ARRAYCOMP:
  #endif
          /*
-          * Emit code for [a, b, c] of the form:
+          * Emit code for [a, b, c] that is equivalent to constructing a new
-          *
+          * array and in source order evaluating each element value and adding
-          *   t = new Array; t[0] = a; t[1] = b; t[2] = c; t;
+          * it to the array, without invoking latent setters.  We use the
-          *
+          * JSOP_NEWINIT and JSOP_INITELEM bytecodes to ignore setters and to
-          * but use a stack slot for t and avoid dup'ing and popping it using
+          * avoid dup'ing and popping the array as each element is added, as
-          * the JSOP_NEWINIT and JSOP_INITELEM bytecodes.
+          * JSOP_SETELEM/JSOP_SETPROP would do.
           *
-          * If no sharp variable is defined and the initialiser is not for an
+          * If no sharp variable is defined, the initializer is not for an array
-          * array comprehension, use JSOP_NEWARRAY.
+          * comprehension, the initializer is not overlarge, and the initializer
+          * is not in global code (whose stack growth cannot be precisely modeled
+          * due to the need to reserve space for global variables and regular
+          * expressions), use JSOP_NEWARRAY to minimize opcodes and to create the
+          * array using a fast, all-at-once process rather than a slow, element-
+          * by-element process.
           */
-         pn2 = pn->pn_head;
-         op = JSOP_NEWINIT;      // FIXME: 260106 patch disabled for now
  #if JS_HAS_SHARP_VARS
-         if (pn2 && pn2->pn_type == TOK_DEFSHARP)
+         sharpnum = -1;
-             op = JSOP_NEWINIT;
+       do_emit_array:
  #endif
+         op = (JS_LIKELY(pn->pn_count < JS_BIT(16)) && (cg->flags & TCF_IN_FUNCTION))
+              ? JSOP_NEWARRAY
+              : JSOP_NEWINIT;
  #if JS_HAS_GENERATORS
          if (pn->pn_type == TOK_ARRAYCOMP)
              op = JSOP_NEWINIT;
  #endif
+ #if JS_HAS_SHARP_VARS
+         JS_ASSERT_IF(sharpnum >= 0, cg->flags & TCF_HAS_SHARPS);
+         if (cg->flags & TCF_HAS_SHARPS)
+             op = JSOP_NEWINIT;
+ #endif
-         if (op == JSOP_NEWINIT &&
+         if (op == JSOP_NEWINIT) {
-             js_Emit2(cx, cg, op, (jsbytecode) JSProto_Array) < 0) {
+             if (js_Emit2(cx, cg, op, (jsbytecode) JSProto_Array) < 0)
-             return JS_FALSE;
+                 return JS_FALSE;
-         }
  #if JS_HAS_SHARP_VARS
-         if (pn2 && pn2->pn_type == TOK_DEFSHARP) {
+             if (sharpnum >= 0)
-             EMIT_UINT16_IMM_OP(JSOP_DEFSHARP, (jsatomid)pn2->pn_num);
+                 EMIT_UINT16_IMM_OP(JSOP_DEFSHARP, (jsatomid) sharpnum);
-             pn2 = pn2->pn_next;
+ # endif
          }
- #endif
  #if JS_HAS_GENERATORS
          if (pn->pn_type == TOK_ARRAYCOMP) {
              uintN saveDepth;
              /*
-              * Pass the new array's stack index to the TOK_ARRAYPUSH case by
+              * Pass the new array's stack index to the TOK_ARRAYPUSH case via
-              * storing it in pn->pn_extra, then simply traverse the TOK_FOR
+              * cg->arrayCompDepth, then simply traverse the TOK_FOR node and
-              * node and its kids under pn2 to generate this comprehension.
+              * its kids under pn2 to generate this comprehension.
               */
              JS_ASSERT(cg->stackDepth > 0);
              saveDepth = cg->arrayCompDepth;
              cg->arrayCompDepth = (uint32) (cg->stackDepth - 1);
-             if (!js_EmitTree(cx, cg, pn2))
+             if (!js_EmitTree(cx, cg, pn->pn_head))
                  return JS_FALSE;
              cg->arrayCompDepth = saveDepth;
-Line 6023
+Line 6436
          }
  #endif /* JS_HAS_GENERATORS */
+         pn2 = pn->pn_head;
          for (atomIndex = 0; pn2; atomIndex++, pn2 = pn2->pn_next) {
              if (op == JSOP_NEWINIT && !EmitNumberOp(cx, atomIndex, cg))
                  return JS_FALSE;
              if (pn2->pn_type == TOK_COMMA) {
                  if (js_Emit1(cx, cg, JSOP_HOLE) < 0)
                      return JS_FALSE;
-Line 6034
+Line 6447
                  if (!js_EmitTree(cx, cg, pn2))
                      return JS_FALSE;
              }
              if (op == JSOP_NEWINIT && js_Emit1(cx, cg, JSOP_INITELEM) < 0)
                  return JS_FALSE;
          }
+         JS_ASSERT(atomIndex == pn->pn_count);
-         if (pn->pn_extra & PNX_ENDCOMMA) {
+         if (pn->pn_xflags & PNX_ENDCOMMA) {
              /* Emit a source note so we know to decompile an extra comma. */
              if (js_NewSrcNote(cx, cg, SRC_CONTINUE) < 0)
                  return JS_FALSE;
          }
-         if (op == JSOP_NEWARRAY) {
+         if (op == JSOP_NEWINIT) {
-             JS_ASSERT(atomIndex == pn->pn_count);
+             /*
-             off = js_EmitN(cx, cg, op, 3);
+              * Emit an op to finish the array and, secondarily, to aid in sharp
-             if (off < 0)
+              * array cleanup (if JS_HAS_SHARP_VARS) and decompilation.
-                 return JS_FALSE;
+              */
-             pc = CG_CODE(cg, off);
-             SET_UINT24(pc, atomIndex);
-             UpdateDepth(cx, cg, off);
-         } else {
-             /* Emit an op for sharp array cleanup and decompilation. */
              if (js_Emit1(cx, cg, JSOP_ENDINIT) < 0)
                  return JS_FALSE;
+             break;
          }
+         JS_ASSERT(atomIndex < JS_BIT(16));
+         EMIT_UINT16_IMM_OP(JSOP_NEWARRAY, atomIndex);
          break;
        case TOK_RC:
+ #if JS_HAS_SHARP_VARS
+         sharpnum = -1;
+       do_emit_object:
+ #endif
  #if JS_HAS_DESTRUCTURING_SHORTHAND
-         if (pn->pn_extra & PNX_SHORTHAND) {
+         if (pn->pn_xflags & PNX_DESTRUCT) {
              js_ReportCompileErrorNumber(cx, CG_TS(cg), pn, JSREPORT_ERROR,
                                          JSMSG_BAD_OBJECT_INIT);
              return JS_FALSE;
          }
  #endif
          /*
-          * Emit code for {p:a, '%q':b, 2:c} of the form:
+          * Emit code for {p:a, '%q':b, 2:c} that is equivalent to constructing
-          *
+          * a new object and in source order evaluating each property value and
-          *   t = new Object; t.p = a; t['%q'] = b; t[2] = c; t;
+          * adding the property to the object, without invoking latent setters.
-          *
+          * We use the JSOP_NEWINIT and JSOP_INITELEM/JSOP_INITPROP bytecodes to
-          * but use a stack slot for t and avoid dup'ing and popping it via
+          * ignore setters and to avoid dup'ing and popping the object as each
-          * the JSOP_NEWINIT and JSOP_INITELEM/JSOP_INITPROP bytecodes.
+          * property is added, as JSOP_SETELEM/JSOP_SETPROP would do.
           */
          if (js_Emit2(cx, cg, JSOP_NEWINIT, (jsbytecode) JSProto_Object) < 0)
              return JS_FALSE;
-         pn2 = pn->pn_head;
  #if JS_HAS_SHARP_VARS
-         if (pn2 && pn2->pn_type == TOK_DEFSHARP) {
+         if (sharpnum >= 0)
-             EMIT_UINT16_IMM_OP(JSOP_DEFSHARP, (jsatomid)pn2->pn_num);
+             EMIT_UINT16_IMM_OP(JSOP_DEFSHARP, (jsatomid) sharpnum);
-             pn2 = pn2->pn_next;
-         }
  #endif
-         for (; pn2; pn2 = pn2->pn_next) {
+         for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
-             /* Emit an index for t[2], else map an atom for t.p or t['%q']. */
+             /* Emit an index for t[2] for later consumption by JSOP_INITELEM. */
              pn3 = pn2->pn_left;
              if (pn3->pn_type == TOK_NUMBER) {
- #ifdef __GNUC__
-                 ale = NULL;     /* quell GCC overwarning */
- #endif
                  if (!EmitNumberOp(cx, pn3->pn_dval, cg))
                      return JS_FALSE;
-             } else {
-                 JS_ASSERT(pn3->pn_type == TOK_NAME ||
-                           pn3->pn_type == TOK_STRING);
-                 ale = js_IndexAtom(cx, pn3->pn_atom, &cg->atomList);
-                 if (!ale)
-                     return JS_FALSE;
              }
              /* Emit code for the property initializer. */
-Line 6122
+Line 6526
                  if (js_Emit1(cx, cg, JSOP_INITELEM) < 0)
                      return JS_FALSE;
              } else {
+                 JS_ASSERT(pn3->pn_type == TOK_NAME ||
+                           pn3->pn_type == TOK_STRING);
+                 ale = cg->atomList.add(cg->compiler, pn3->pn_atom);
+                 if (!ale)
+                     return JS_FALSE;
                  EMIT_INDEX_OP(JSOP_INITPROP, ALE_INDEX(ale));
              }
          }
-Line 6133
+Line 6542
  #if JS_HAS_SHARP_VARS
        case TOK_DEFSHARP:
-         if (!js_EmitTree(cx, cg, pn->pn_kid))
+         JS_ASSERT(cg->flags & TCF_HAS_SHARPS);
+         sharpnum = pn->pn_num;
+         pn = pn->pn_kid;
+         if (pn->pn_type == TOK_RB)
+             goto do_emit_array;
+ # if JS_HAS_GENERATORS
+         if (pn->pn_type == TOK_ARRAYCOMP)
+             goto do_emit_array;
+ # endif
+         if (pn->pn_type == TOK_RC)
+             goto do_emit_object;
+         if (!js_EmitTree(cx, cg, pn))
              return JS_FALSE;
-         EMIT_UINT16_IMM_OP(JSOP_DEFSHARP, (jsatomid) pn->pn_num);
+         EMIT_UINT16_IMM_OP(JSOP_DEFSHARP, (jsatomid) sharpnum);
          break;
        case TOK_USESHARP:
+         JS_ASSERT(cg->flags & TCF_HAS_SHARPS);
          EMIT_UINT16_IMM_OP(JSOP_USESHARP, (jsatomid) pn->pn_num);
          break;
  #endif /* JS_HAS_SHARP_VARS */
-Line 6152
+Line 6574
           * assignment expressions in conditions to avoid the error correction
           * done by Condition (from x = y to x == y) by double-parenthesizing.
           */
-         oldflags = cg->treeContext.flags;
+         oldflags = cg->flags;
-         cg->treeContext.flags &= ~TCF_IN_FOR_INIT;
+         cg->flags &= ~TCF_IN_FOR_INIT;
          if (!js_EmitTree(cx, cg, pn->pn_kid))
              return JS_FALSE;
-         cg->treeContext.flags |= oldflags & TCF_IN_FOR_INIT;
+         cg->flags |= oldflags & TCF_IN_FOR_INIT;
          break;
        }
        case TOK_NAME:
+         /*
+          * Cope with a left-over function definition that was replaced by a use
+          * of a later function definition of the same name. See FunctionDef and
+          * MakeDefIntoUse in jsparse.cpp.
+          */
+         if (pn->pn_op == JSOP_NOP)
+             return JS_TRUE;
          if (!EmitNameOp(cx, cg, pn, JS_FALSE))
              return JS_FALSE;
          break;
-Line 6189
+Line 6618
           * select JSOP_REGEXP.
           */
          JS_ASSERT(pn->pn_op == JSOP_REGEXP);
-         if (cg->treeContext.flags & TCF_COMPILE_N_GO) {
+         if (cg->flags & TCF_COMPILE_N_GO) {
-             ok = EmitObjectOp(cx, pn->pn_pob, JSOP_OBJECT, cg);
+             ok = EmitObjectOp(cx, pn->pn_objbox, JSOP_OBJECT, cg);
          } else {
              ok = EmitIndexOp(cx, JSOP_REGEXP,
-                              IndexParsedObject(pn->pn_pob, &cg->regexpList),
+                              cg->regexpList.index(pn->pn_objbox),
                               cg);
          }
          break;
-Line 6217
+Line 6646
        case TOK_XMLELEM:
        case TOK_XMLLIST:
          if (pn->pn_op == JSOP_XMLOBJECT) {
-             ok = EmitObjectOp(cx, pn->pn_pob, PN_OP(pn), cg);
+             ok = EmitObjectOp(cx, pn->pn_objbox, PN_OP(pn), cg);
              break;
          }
-         JS_ASSERT(pn->pn_type == TOK_XMLLIST || pn->pn_count != 0);
+         JS_ASSERT(PN_TYPE(pn) == TOK_XMLLIST || pn->pn_count != 0);
-         switch (pn->pn_head ? pn->pn_head->pn_type : TOK_XMLLIST) {
+         switch (pn->pn_head ? PN_TYPE(pn->pn_head) : TOK_XMLLIST) {
            case TOK_XMLETAGO:
              JS_ASSERT(0);
              /* FALL THROUGH */
-Line 6245
+Line 6674
                  return JS_FALSE;
          }
-         if (pn->pn_extra & PNX_XMLROOT) {
+         if (pn->pn_xflags & PNX_XMLROOT) {
              if (pn->pn_count == 0) {
                  JS_ASSERT(pn->pn_type == TOK_XMLLIST);
                  atom = cx->runtime->atomState.emptyAtom;
-                 ale = js_IndexAtom(cx, atom, &cg->atomList);
+                 ale = cg->atomList.add(cg->compiler, atom);
                  if (!ale)
                      return JS_FALSE;
                  EMIT_INDEX_OP(JSOP_STRING, ALE_INDEX(ale));
-Line 6265
+Line 6694
        case TOK_XMLPTAGC:
          if (pn->pn_op == JSOP_XMLOBJECT) {
-             ok = EmitObjectOp(cx, pn->pn_pob, PN_OP(pn), cg);
+             ok = EmitObjectOp(cx, pn->pn_objbox, PN_OP(pn), cg);
              break;
          }
          /* FALL THROUGH */
-Line 6278
+Line 6707
          if (js_Emit1(cx, cg, JSOP_STARTXML) < 0)
              return JS_FALSE;
-         ale = js_IndexAtom(cx,
+         ale = cg->atomList.add(cg->compiler,
-                            (pn->pn_type == TOK_XMLETAGO)
+                                (pn->pn_type == TOK_XMLETAGO)
-                            ? cx->runtime->atomState.etagoAtom
+                                ? cx->runtime->atomState.etagoAtom
-                            : cx->runtime->atomState.stagoAtom,
+                                : cx->runtime->atomState.stagoAtom);
-                            &cg->atomList);
          if (!ale)
              return JS_FALSE;
          EMIT_INDEX_OP(JSOP_STRING, ALE_INDEX(ale));
-Line 6313
+Line 6741
              }
          }
-         ale = js_IndexAtom(cx,
+         ale = cg->atomList.add(cg->compiler,
-                            (pn->pn_type == TOK_XMLPTAGC)
+                                (pn->pn_type == TOK_XMLPTAGC)
-                            ? cx->runtime->atomState.ptagcAtom
+                                ? cx->runtime->atomState.ptagcAtom
-                            : cx->runtime->atomState.tagcAtom,
+                                : cx->runtime->atomState.tagcAtom);
-                            &cg->atomList);
          if (!ale)
              return JS_FALSE;
          EMIT_INDEX_OP(JSOP_STRING, ALE_INDEX(ale));
          if (js_Emit1(cx, cg, JSOP_ADD) < 0)
              return JS_FALSE;
-         if ((pn->pn_extra & PNX_XMLROOT) && js_Emit1(cx, cg, PN_OP(pn)) < 0)
+         if ((pn->pn_xflags & PNX_XMLROOT) && js_Emit1(cx, cg, PN_OP(pn)) < 0)
              return JS_FALSE;
          break;
        }
-Line 6333
+Line 6760
          if (pn->pn_arity == PN_LIST) {
              JS_ASSERT(pn->pn_count != 0);
              for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
+                 if (pn2->pn_type == TOK_LC &&
+                     js_Emit1(cx, cg, JSOP_STARTXMLEXPR) < 0) {
+                     return JS_FALSE;
+                 }
                  if (!js_EmitTree(cx, cg, pn2))
                      return JS_FALSE;
                  if (pn2 != pn->pn_head && js_Emit1(cx, cg, JSOP_ADD) < 0)
-Line 6341
+Line 6772
          } else {
              JS_ASSERT(pn->pn_arity == PN_NULLARY);
              ok = (pn->pn_op == JSOP_OBJECT)
-                  ? EmitObjectOp(cx, pn->pn_pob, PN_OP(pn), cg)
+                  ? EmitObjectOp(cx, pn->pn_objbox, PN_OP(pn), cg)
                   : EmitAtomOp(cx, pn, PN_OP(pn), cg);
          }
          break;
        case TOK_XMLPI:
-         ale = js_IndexAtom(cx, pn->pn_atom2, &cg->atomList);
+         ale = cg->atomList.add(cg->compiler, pn->pn_atom2);
          if (!ale)
              return JS_FALSE;
          if (!EmitIndexOp(cx, JSOP_QNAMEPART, ALE_INDEX(ale), cg))
-Line 6361
+Line 6792
          JS_ASSERT(0);
      }
-     if (ok && --cg->emitLevel == 0 && cg->spanDeps)
+     if (ok && --cg->emitLevel == 0) {
-         ok = OptimizeSpanDeps(cx, cg);
+         if (cg->spanDeps)
+             ok = OptimizeSpanDeps(cx, cg);
+         if (!UpdateLineNumberNotes(cx, cg, pn->pn_pos.end.lineno))
+             return JS_FALSE;
+     }
      return ok;
  }
-Line 6622
+Line 7057
              /*
               * Simultaneously test to see if the source note array must grow to
-              * accomodate either the first or second byte of additional storage
+              * accommodate either the first or second byte of additional storage
               * required by this 3-byte offset.
               */
              if (((CG_NOTE_COUNT(cg) + 1) & CG_NOTE_MASK(cg)) <= 1) {
-Line 6791
+Line 7226
   * Since the emitter refers to each parsed object only once, for the index we
   * use the number of already indexes objects. We also add the object to a list
   * to convert the list to a fixed-size array when we complete code generation,
-  * see FinishParsedObjects bellow.
+  * see JSCGObjectList::finish below.
   *
-  * Most of the objects go to JSCodeGenerator.objectList but for regexp we use
+  * Most of the objects go to JSCodeGenerator.objectList but for regexp we use a
-  * a separated JSCodeGenerator.regexpList. In this way the emitted index can
+  * separated JSCodeGenerator.regexpList. In this way the emitted index can be
-  * be directly used to store and fetch a reference to a cloned RegExp object
+  * directly used to store and fetch a reference to a cloned RegExp object that
-  * that shares the same JSRegExp private data created for the object literal
+  * shares the same JSRegExp private data created for the object literal in
-  * in pob. We need clones to hold lastIndex and other direct properties that
+  * objbox. We need a cloned object to hold lastIndex and other direct properties
-  * should not be shared among threads sharing a precompiled function or
+  * that should not be shared among threads sharing a precompiled function or
   * script.
   *
   * If the code being compiled is function code, allocate a reserved slot in
-Line 6810
+Line 7245
   * one of the slots that should be given to a regexp clone.
   *
   * If the code being compiled is global code, the cloned regexp are stored in
-  * fp->vars slot after cg->treeContext.ngvars and to protect regexp slots from
+  * fp->vars slot after cg->ngvars and to protect regexp slots from GC we set
-  * GC we set fp->nvars to ngvars + nregexps.
+  * fp->nvars to ngvars + nregexps.
   *
   * The slots initially contain undefined or null. We populate them lazily when
   * JSOP_REGEXP is executed for the first time.
-Line 6828
+Line 7263
   * __parent__ refer to the pre-compilation prototype and global objects, a
   * pigeon-hole problem for instanceof tests.
   */
- static uintN
+ uintN
- IndexParsedObject(JSParsedObjectBox *pob, JSEmittedObjectList *list)
+ JSCGObjectList::index(JSObjectBox *objbox)
  {
-     JS_ASSERT(!pob->emitLink);
+     JS_ASSERT(!objbox->emitLink);
-     pob->emitLink = list->lastPob;
+     objbox->emitLink = lastbox;
-     list->lastPob = pob;
+     lastbox = objbox;
-     return list->length++;
+     return length++;
  }
  void
- FinishParsedObjects(JSEmittedObjectList *emittedList, JSObjectArray *array)
+ JSCGObjectList::finish(JSObjectArray *array)
  {
      JSObject **cursor;
-     JSParsedObjectBox *pob;
+     JSObjectBox *objbox;
-     JS_ASSERT(emittedList->length <= INDEX_LIMIT);
+     JS_ASSERT(length <= INDEX_LIMIT);
-     JS_ASSERT(emittedList->length == array->length);
+     JS_ASSERT(length == array->length);
      cursor = array->vector + array->length;
-     pob = emittedList->lastPob;
+     objbox = lastbox;
      do {
          --cursor;
          JS_ASSERT(!*cursor);
-         *cursor = pob->object;
+         *cursor = objbox->object;
-     } while ((pob = pob->emitLink) != NULL);
+     } while ((objbox = objbox->emitLink) != NULL);
      JS_ASSERT(cursor == array->vector);
  }

 Legend:



Removed from v.459
 


changed lines


 
Added in v.460
 Legend:



Removed from v.459
 


changed lines


 
Added in v.460
-Removed from v.459
+Added in v.460

	ViewVC Help
Powered by ViewVC 1.1.24